auth0
Auth0 Authentication API Error Codes
Error identifiers returned in the error field of Auth0 Authentication API responses (e.g. /oauth/token, /dbconnections/signup, and the Multi-Factor Authentication API), beyond the standard OAuth 2.0 / OIDC codes.
12 codes
references auth0.com/docs/api/authenticationauth0.com/docs/secure/multi-factor-authentication/auth0-guardian/guardian-error-code-reference
· All codes 12 codes
- association_required Association Required The user has no MFA authenticator enrolled. The client must direct the user through the enrollment flow (associate a new authenticator) before a challenge can be issued.
- authorization_pending Authorization Pending The out-of-band (push or SMS) MFA challenge has been sent but not yet approved by the user. The client should poll the /oauth/token endpoint again after a short delay.
- expired_token Expired Token A token supplied in the request — such as the mfa_token from an MFA challenge, or a ticket/ID used in a password-reset or email-verification link — has expired and must be reissued.
- invalid_signup Invalid Signup The /dbconnections/signup request could not create the user, most often because the account already exists on that database connection. Some tenant configurations return this in place of the more specific user_exists code.
- invalid_user_password Invalid User Password The username/email and password combination submitted to a Resource Owner Password grant or database connection login does not match any user.
- mfa_required MFA Required Returned from the /oauth/token endpoint when the user has multi-factor authentication enrolled and must complete an MFA challenge. The response includes an mfa_token that must be passed to the MFA API to complete the challenge.
- password_leaked Password Leaked The submitted password was found in a database of credentials leaked in a known breach (via Auth0's breached-password detection). The user must reset their password before they can authenticate.
- slow_down Slow Down The client is polling the /oauth/token endpoint for an out-of-band MFA challenge result too frequently. The client should increase its polling interval.
- too_many_attempts Too Many Attempts The account has been temporarily blocked after too many consecutive failed login or MFA verification attempts, as a brute-force protection measure. The user must wait or complete an unblock flow before retrying.
- unauthorized Unauthorized A generic denial returned when a custom Database Action or Rule throws an error during login; the thrown message is surfaced in the response's error_description field.
- unsupported_challenge_type Unsupported Challenge Type Returned by the MFA challenge endpoint when the client requests a challenge type (e.g. oob, otp) that none of the user's enrolled authenticators support.
- user_exists User Exists The /dbconnections/signup request targeted a database connection where a user with the given email or username already exists.