ory/kratos · error

no credentials found

Error message

no credentials found

What it means

ErrNoCredentialsFound is the identifier-first login strategy's signal that it cannot hydrate/complete a login because the user has no usable credentials. In the code strategy it is returned when passwordless code login is disabled, or when there is no identity hint and account-enumeration mitigation is disabled.

Solutions

1. Enable passwordless code login (selfservice.methods.code.passwordless_enabled: true) so users can always sign in via code
2. Enable account enumeration mitigation (security.account_enumeration_mitigate: true) so the flow returns a generic response instead of leaking existence
3. Ensure the identifier the user typed actually belongs to an identity with credentials registered (password/passkey/code)
4. Handle the error in the UI as 'no login method available for this identifier' and route the user to registration/recovery

Example fix

// before (config.yml)
selfservice:
  methods:
    code:
      passwordless_enabled: false
// after
selfservice:
  methods:
    code:
      passwordless_enabled: true
  security:
    account_enumeration_mitigate: true

// before initiating login, check the method is enabled
if !config.SelfServiceCodeStrategy(ctx).PasswordlessEnabled {
  // don't rely on code login for this identifier
}

if errors.Is(err, idfirst.ErrNoCredentialsFound) {
  // render generic 'no login method for this identifier' UI;
  // offer registration or recovery links
}

When it happens

Trigger: Login flow where the identity-first strategy finds no registered credential method: (1) code strategy's PopulateLoginMethodIdentifierFirstCredentials runs while SelfServiceCodeStrategy.PasswordlessEnabled is false; (2) no identity hint available and SecurityAccountEnumerationMitigate is false (code/strategy_login.go:712,718).

Common situations: Users attempting login with an email that has no verifiable credentials; deployments where passwordless (one-time-code) login was disabled after users were enrolled; hint flows where the identity resolution returned nil.

Related errors

• verification requested for unknown address
• api_key auth strategy requires a string name
• api_key auth strategy requires a string value
• basic_auth auth strategy requires a string user
• basic_auth auth strategy requires a string password

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/5c0b8d4ca080de41. Report an issue: GitHub.

Appendix: source

Thrown at selfservice/strategy/idfirst/strategy_login.go:31

	"github.com/ory/kratos/schema"

	"github.com/pkg/errors"

	"github.com/ory/kratos/identity"
	"github.com/ory/kratos/selfservice/flow"
	"github.com/ory/kratos/selfservice/flow/login"
	"github.com/ory/kratos/session"
	"github.com/ory/kratos/text"
	"github.com/ory/kratos/ui/node"
	"github.com/ory/kratos/x"
	"github.com/ory/x/decoderx"
	"github.com/ory/x/sqlcon"
)

var (
	_                     login.AAL1FormHydrator = new(Strategy)
	_                     login.Strategy         = new(Strategy)
	ErrNoCredentialsFound                        = errors.New("no credentials found")
)

func (s *Strategy) handleLoginError(r *http.Request, f *login.Flow, payload UpdateLoginFlowWithIdentifierFirstMethod, err error) error {
	if f != nil {
		f.UI.Nodes.SetValueAttribute("identifier", payload.Identifier)
		if f.Type == flow.TypeBrowser {
			f.UI.SetCSRF(s.d.GenerateCSRFToken(r))
		}
	}

	return err
}

func (s *Strategy) Login(w http.ResponseWriter, r *http.Request, f *login.Flow, sess *session.Session) (_ *identity.Identity, err error) {
	ctx, span := s.d.Tracer(r.Context()).Tracer().Start(r.Context(), "selfservice.strategy.idfirst.Strategy.Login")
	defer otelx.End(span, &err)

	if !s.d.Config().SelfServiceLoginFlowIdentifierFirstEnabled(ctx) {

View on GitHub (pinned to b86338da04)