langgenius/dify · error · AccountRegisterError

Invalid email or password

Error message

Invalid email or password

What it means

Raised as AccountRegisterError at oauth.py:314 — the fallback branch for a new OAuth identity when registration is disabled and the email is NOT in freeze. The description 'Invalid email or password' is deliberately generic (it does NOT reflect a real credential check; OAuth users have password=None). The OAuth callback redirects the browser to /signin?message=Invalid email or password. This is a registration-gate error disguised as a credential error.

Source

Thrown at api/controllers/console/auth/oauth.py:314

            if not FeatureService.is_workspace_creation_allowed():
                raise WorkSpaceNotAllowedCreateError()
            else:
                TenantService.create_owner_tenant(account, session=db.session())

    if not account:
        normalized_email = user_info.email.lower()
        oauth_new_user = True
        if not FeatureService.get_system_features().is_allow_register:
            if dify_config.DEPLOYMENT_EDITION == DeploymentEdition.CLOUD and BillingService.is_email_in_freeze(
                normalized_email
            ):
                raise AccountRegisterError(
                    description=(
                        "This email account has been deleted within the past "
                        "30 days and is temporarily unavailable for new account registration"
                    )
                )
            raise AccountRegisterError(description=("Invalid email or password"))
        account_name = user_info.name or "Dify"
        interface_language = _preferred_interface_language(language)
        account = RegisterService.register(
            email=normalized_email,
            name=account_name,
            password=None,
            open_id=user_info.id,
            provider=provider,
            language=interface_language,
            timezone=timezone,
            session=db.session(),
        )

    # Link account
    AccountService.link_account_integrate(provider, user_info.id, account, session=db.session())

    return account, oauth_new_user

View on GitHub (pinned to ef8544b173)

Solutions

1. Have an admin pre-create the account or send an invite so the OAuth identity links to an existing account instead of hitting the register path.
2. Enable FeatureService.get_system_features().is_allow_register if self-service registration is intended.
3. Recognize that for OAuth flows this message means 'registration disabled + no existing account', not a bad password — do not waste cycles resetting credentials.
4. Improve the description string at oauth.py:314 to something like 'Registration is disabled; ask your admin to invite you.' for clarity.

Example fix

// before (oauth.py:314)
raise AccountRegisterError(description=("Invalid email or password"))
// after
raise AccountRegisterError(
    description="Registration is disabled. Contact your workspace admin to invite you."
)

// Recognize that for OAuth, 'Invalid email or password' actually means
// 'no account + registration disabled'. Do NOT attempt password reset.
const msg = new URL(window.location.href).searchParams.get('message') || '';
if (msg === 'Invalid email or password' && isOAuthFlow) {
  promptAdminInvite();
}

try {
  await completeOAuthCallback();
} catch (e) {
  if (/Invalid email or password/i.test(String(e.message||e)) && oauthFlow) {
    showRegistrationDisabledNotice();
  } else { throw e; }
}

When it happens

Trigger: OAuth callback for a new identity on a deployment where FeatureService.get_system_features().is_allow_register is False, and the email is either not Cloud-frozen or the edition is not CLOUD. Falls through to oauth.py:314.

Common situations: Self-hosted or Cloud deployment with registration locked down; an external SSO user not yet provisioned tries to sign in and gets a misleading 'Invalid email or password' message. Admins misread this as a credential problem when it is really a missing-account + registration-disabled condition.

Related errors

• Workspace not found, please contact system admin to invite y
• This email account has been deleted within the past 30 days
• access_denied
• server_5xx
• email_send_ip_limit

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/4792a70c96397a4f. Report an issue: GitHub.