ory/kratos · warning

required credentials not found

Error message

required credentials not found

What it means

ErrNoCredentials is the sentinel error from x/webauthnx (identifier-first flows) signaling that no usable credentials/hints were found to populate the identifier-first login step. Strategies like the code strategy re-wrap idfirst.ErrNoCredentialsFound when passwordless is disabled or account-enumeration mitigation withholds identity hints. It lets callers distinguish 'no credentials known' from real failures.

Solutions

1. Enable code passwordless: set selfservice.methods.code.passwordless_enabled: true in config if one-tap login is intended
2. If mitigation is enabled, expect this error for unknown identifiers and show a generic 'check your email' message instead of a hard failure
3. Verify the identifier exists via the identifier-first flow before attempting code login
4. Use errors.Is(err, idfirst.ErrNoCredentialsFound) to detect this case and branch UI accordingly

Example fix

// before
err := s.d.RegistrationExecutor().PostRegistrationHook(...)
// treat any error as fatal
// after
if errors.Is(err, idfirst.ErrNoCredentialsFound) {
    // show neutral "check your inbox" message
    return nil
}

// client-side: only attempt passwordless login if the identifier is known-registered and passwordless is enabled

if errors.Is(err, idfirst.ErrNoCredentialsFound) { showNeutralMessage(); return nil } // do not leak whether identifier exists

When it happens

Trigger: Passwordless code login attempted while selfservice.methods.code.passwordless_enabled is false; an identifier-first login submits an unknown identifier while security.account_enumeration_mitigation.enabled is true (hint withheld).

Common situations: End user tries one-tap code login before any identity exists; admin disabled passwordless after users saved the flow as a bookmark; enumeration mitigation intentionally returning this error for unknown identifiers.

Related errors

• no identifier found
• failed to decode PEM block containing private key
• Private key is not ecdsa key
• no oidc provider was set
• the provided number is not a valid phone number

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/48ae1fb7662e5b69. Report an issue: GitHub.

Appendix: source

Thrown at x/webauthnx/errors.go:12

// Copyright © 2023 Ory Corp
// SPDX-License-Identifier: Apache-2.0

package webauthnx

import (
	"github.com/pkg/errors"

	"github.com/ory/jsonschema/v3"
)

var ErrNoCredentials = errors.New("required credentials not found")

func ErrNotEnoughCredentials() *jsonschema.ValidationError {
	return &jsonschema.ValidationError{Message: "unable to remove this security key because it would lock you out of your account", InstancePtr: "#/webauthn_remove"}
}

// ErrCredentialAlreadyRegistered is returned when a settings flow submits a credential whose ID
// is already registered on the identity. Compliant browsers prevent this via excludeCredentials,
// so this guards against clients that ignore the exclusion list.
func ErrCredentialAlreadyRegistered(instancePtr string) *jsonschema.ValidationError {
	return &jsonschema.ValidationError{Message: "this security key or passkey is already registered with your account", InstancePtr: instancePtr}
}

View on GitHub (pinned to b86338da04)