mastra-ai/mastra · error · HTTPException

Invalid email or password

Error message

Invalid email or password

What it means

This 401 is thrown by the POST /auth/credentials/sign-in handler in packages/server when the credentials provider's signIn call fails for any reason. The handler deliberately returns a generic message ('Invalid email or password') instead of the underlying error, to avoid leaking whether an account exists. Any non-HTTPException failure inside the sign-in flow — not just wrong passwords — is collapsed into this response.

Source

Thrown at packages/server/src/server/handlers/auth.ts:708

      });

      // Build response headers, including cookies from the auth provider
      const headers = new Headers({
        'Content-Type': 'application/json',
      });

      // Forward session cookies from the auth provider
      if (result.cookies?.length) {
        for (const cookie of result.cookies) {
          headers.append('Set-Cookie', cookie);
        }
      }

      return new Response(responseBody, { status: 200, headers });
    } catch (error) {
      if (error instanceof HTTPException) throw error;
      // Return a generic error for auth failures to avoid leaking info
      throw new HTTPException(401, { message: 'Invalid email or password' });
    }
  },
});

// ============================================================================
// POST /auth/credentials/sign-up
// ============================================================================

export const POST_CREDENTIALS_SIGN_UP_ROUTE = createPublicRoute({
  method: 'POST',
  path: '/auth/credentials/sign-up',
  responseType: 'datastream-response',
  bodySchema: credentialsSignUpBodySchema,
  summary: 'Sign up with credentials',
  description: 'Creates a new user account with email and password.',
  tags: ['Auth'],
  handler: async ctx => {
    const { mastra, request, email, password, name } = ctx as any;

View on GitHub (pinned to 75dd419e61)

Solutions

1. Verify the email/password pair is correct (user exists and password matches) via the sign-up flow or a password reset.
2. Check server logs — the handler may not log the underlying error, so reproduce locally and inspect the credentials provider's signIn implementation for non-auth exceptions.
3. Confirm the credentials auth provider is properly configured on the Mastra instance (server-ops), since a broken provider surfaces as this same 401.
4. If you own the handler and need distinguishable errors, log error.message server-side before rethrowing the generic 401 — do not change the response message.

Example fix

// before (client)
const res = await fetch('/auth/credentials/sign-in', { method: 'POST', body: JSON.stringify({ email, password }) });
if (!res.ok) throw new Error(await res.text());

// after (client: surface a friendly message on 401)
if (res.status === 401) throw new Error('Invalid email or password. Please check your credentials or reset your password.');

if (!email || !email.includes('@') || !password) {
  throw new Error('Email and password are required before calling sign-in');
}

try {
  const res = await fetch('/auth/credentials/sign-in', { method: 'POST', body: JSON.stringify({ email, password }) });
  if (res.status === 401) throw new SignInError('Invalid email or password');
  if (!res.ok) throw new SignInError(`Sign-in failed: ${res.status}`);
} catch (e) {
  // Never retry blindly; surface a generic message and offer password reset
  showLoginError(e instanceof SignInError ? e.message : 'Unable to sign in');
}

When it happens

Trigger: POST /auth/credentials/sign-in with an email that has no registered user; a wrong password for an existing user; a credentials provider that is not configured and fails internally; any unexpected exception thrown by the provider's signIn() (DB down, provider bug), since the catch block converts everything non-HTTPException into this 401.

Common situations: Typos or stale credentials in client login forms; user never completed sign-up; passwords reset out-of-band; database unavailable so the user lookup fails and is masked as a credential error; developer misreads the generic message and can't tell auth failure from provider misconfiguration.

Related errors

• Invalid email or password
• invalid API key or insufficient permissions
• Authentication failed / server-provided message
• Kimi For Coding credentials have an invalid device ID. Pleas
• Session expired. Run: mastra auth login

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/92eaeb48c63dc66f. Report an issue: GitHub.