makeplane/plane · error · AuthenticationException

5005

5005

Error message

INVALID_EMAIL

What it means

In the authentication adapter's sanitize_email, the first check is that an email value is truthy. If email is None, empty string, or otherwise falsy, AuthenticationException is raised with error_code 5005 (INVALID_EMAIL) and the raw email in the payload. This is the 'missing email' branch, distinct from the 'malformed email' branch at line 82.

Source

Thrown at apps/api/plane/authentication/adapter/base.py:68

        raise NotImplementedError

    def set_token_data(self, data):
        self.token_data = data

    def set_user_data(self, data):
        self.user_data = data

    def create_update_account(self, user):
        raise NotImplementedError

    def authenticate(self):
        raise NotImplementedError

    def sanitize_email(self, email):
        # Check if email is present
        if not email:
            self.logger.error("Email is not present")
            raise AuthenticationException(
                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
                error_message="INVALID_EMAIL",
                payload={"email": email},
            )

        # Sanitize email
        email = str(email).lower().strip()

        # validate email
        try:
            validate_email(email)
        except ValidationError:
            self.logger.warning("Email is not valid")
            raise AuthenticationException(
                error_code=AUTHENTICATION_ERROR_CODES["INVALID_EMAIL"],
                error_message="INVALID_EMAIL",
                payload={"email": email},
            )

View on GitHub (pinned to 1c8a60f858)

Solutions

  1. Ensure the client always sends a non-empty email field for auth endpoints.
  2. Add required-field validation on the request serializer before reaching the adapter.
  3. Surface error_code 5005 to the user as 'Email is required'.

Example fix

# before
adapter.sanitize_email(payload.get('email'))

# after
email = (payload.get('email') or '').strip()
if not email:
    raise ValidationError({'email': 'This field is required.'})
adapter.sanitize_email(email)
Defensive patterns

Strategy: validation

Validate before calling

email = (payload.get('email') or '').strip()
if not email:
    raise ValidationError({'email': 'required'})

Type guard

def is_present_email(v): return isinstance(v, str) and v.strip() != ''

Try / catch

try:
    adapter.sanitize_email(payload.get('email'))
except AuthenticationException as e:
    if e.error_code == 5005 and not payload.get('email'):
        return bad_request('Email is required')
    raise

Prevention

When it happens

Trigger: Sign-up/sign-in request where the email field is omitted or empty; JSON body missing the email key; form data where email input is blank.

Common situations: Client bug sending { password: '...' } with no email; middleware stripping empty fields; mobile client not binding the email input.

Related errors

AI-assisted analysis of makeplane/plane@1c8a60f858 (2026-08-12). Data as JSON: /api/errors/dc5927d4f5731fc5. Report an issue: GitHub.