yarnpkg/yarn · error · MessageError

incorrectCredentials

Error message

incorrectCredentials

What it means

In the interactive login flow, after submitting username/password the code expects a token back (login.js ~token assignment). Reaching the `throw ... 'incorrectCredentials'` branch means the registry did not return a token for the supplied credentials, i.e. authentication failed.

Source

Thrown at src/cli/commands/login.js:127

    body: userobj,
    auth: {username, password, email},
  });

  if (res && res.ok) {
    reporter.success(reporter.lang('loggedIn'));

    const token = res.token;
    config.registries.npm.setToken(`Bearer ${token}`);

    return async function revoke(): Promise<void> {
      reporter.success(reporter.lang('revokedToken'));
      await config.registries.npm.request(`-/user/token/${token}`, {
        method: 'DELETE',
        registry,
      });
    };
  } else {
    throw new MessageError(reporter.lang('incorrectCredentials'));
  }
}

export function hasWrapper(commander: Object, args: Array<string>): boolean {
  return true;
}

export function setFlags(commander: Object) {
  commander.description('Stores registry username and email.');
}

export async function run(config: Config, reporter: Reporter, flags: Object, args: Array<string>): Promise<void> {
  await getCredentials(config, reporter);
}

View on GitHub (pinned to c2dda503f3)

Solutions

1. Re-run `yarn login` and re-enter username and password carefully.
2. Verify the account at the registry web UI (npmjs.com) and reset password if needed.
3. Disable autofill / re-type credentials manually to rule out stale values.
4. If 2FA/SSO is required, follow the registry-specific flow or use a personal access token via NPM_AUTH_TOKEN instead.

try {
  await runYarn(['login']);
} catch (e) {
  if (/incorrectCredentials/.test(e.message)) {
    console.error('Login failed: check username/password, 2FA, or use a personal access token.');
    return;
  }
  throw e;
}

When it happens

Trigger: Typo in username or password; expired/locked account; password manager autofill error; account requiring 2FA where the flow did not complete; registry returning an empty/missing token object.

Common situations: Caps-lock / wrong keyboard layout; stale saved credentials; account disabled after failed attempts; corporate npm registry with SSO that needs a different login path.

Related errors

• nonInteractiveNoToken
• workspacesAddRootCheck
• installCommandRenamed
• linkMissing
• unknownPackageName

AI-assisted analysis of yarnpkg/yarn@c2dda503f3 (2026-08-13). Data as JSON: /api/errors/a7e913c6c3fcccb0. Report an issue: GitHub.