nextcloud/all-in-one · error · \Exception

Could not log in to deSEC for {email} yet. Two things to che

Error message

Could not log in to deSEC for {email} yet. Two things to check:
• If deSEC emailed you a verification link, please click it and then try again.
• If this email already had a deSEC account, no new account was created. In that case, enter your existing deSEC password in the password field below and try again.

What it means

Wrapped hint thrown by the private loginAfterVerification() when the immediate login attempt right after account registration fails. Because deSEC returns 202 both for a genuinely new (unverified) account and for an email that already belonged to an existing account, the code cannot tell the two apart and throws one message covering both causes: click the emailed verification link, or supply the existing account's real password.

Source

Thrown at php/src/Desec/DesecManager.php:227

    /**
     * Attempts to log in after the user was asked to verify a freshly created account.
     *
     * A login failure here has two common causes that we cannot tell apart, because
     * deSEC returns 202 both for a genuinely new account and for one whose email was
     * already registered (to prevent email enumeration):
     *   1. The account is new but its email has not been verified yet.
     *   2. The email already belonged to an existing deSEC account, so no new account
     *      (and no verification mail) was created and our generated password is wrong.
     * The message covers both and points to the fix for each.
     *
     * @throws \Exception with a friendly hint when login is not yet possible
     */
    private function loginAfterVerification(string $email, string $password): string {
        try {
            return $this->loginAccount($email, $password);
        } catch (\Exception $e) {
            throw new \Exception(
                'Could not log in to deSEC for ' . $email . ' yet. Two things to check:' . "\n"
                . '• If deSEC emailed you a verification link, please click it and then try again.' . "\n"
                . '• If this email already had a deSEC account, no new account was created. '
                . 'In that case, enter your existing deSEC password in the password field below and try again.'
            );
        }
    }

    /**
     * Authenticates with an existing deSEC account and returns the API token issued for it.
     *
     * @throws \Exception on invalid credentials, network failure, or an unexpected HTTP response
     */
    public function loginAccount(string $email, string $password): string {
        try {
            $res = $this->guzzleClient->post($this->configurationManager->desecApiBase . '/auth/login/', [
                'json' => ['email' => $email, 'password' => $password],
            ]);

View on GitHub (pinned to 6b788eec5e)

Solutions

1. Open the deSEC verification email (check spam) and click the link, then retry
2. If the email already had a deSEC account, type that account's existing password into the password field instead of leaving the generated one
3. Wait a minute for mail delivery before retrying
4. If still stuck, log in at desec.io directly to determine which of the two cases applies

// This message is user-facing by design: catch and render it, do not re-wrap
try {
    $manager->register($email, $slug, $password);
} catch (\Exception $e) {
    if (str_contains($e->getMessage(), 'Could not log in to deSEC for')) {
        renderAwaitingVerificationHint($e->getMessage()); // tell user: click link OR enter existing password
        return;
    }
    throw $e;
}

When it happens

Trigger: registerAccount() returned 202, then loginAccount() threw: the verification email link has not been clicked yet, or the email already owned a deSEC account so no new account (and no matching generated password) exists.

Common situations: Verification email sitting unread in the spam folder; user re-runs the AIO domain wizard with an email that already has a deSEC account; slow mail delivery so the user retries before clicking the link.

Related errors

• Unexpected response from deSEC during login (HTTP {code}): {
• A domain is already configured. Reset the AIO instance first
• Please provide a valid email address.
• The desired subdomain must contain only lowercase letters, d
• Could not reach the deSEC API: {message}

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/046f9ab0077dbeb5. Report an issue: GitHub.