supabase

Supabase Auth Error Codes

Error identifiers returned in the code field of Supabase Auth (GoTrue) API error responses, used across supabase-js, supabase-py, and the other client libraries to identify what went wrong during sign-up, sign-in, MFA, and identity linking.

87 codes

references supabase.com/docs/guides/auth/debugging/error-codes supabase.com/docs/guides/api/handling-errors-in-supabase-js

· All codes 87 codes

anonymous_provider_disabled Anonymous Provider Disabled Anonymous sign-ins are disabled on the Auth server. Returned with HTTP 422.
bad_code_verifier Bad Code Verifier The PKCE code verifier provided does not match the previously stored code challenge, usually indicating a bug in the client library implementation being used. Returned with HTTP 404.
bad_json Bad JSON The HTTP body of the request is not valid JSON. Returned with HTTP 400; check that the request body is well-formed and the Content-Type header is set correctly.
bad_jwt Bad JWT The JWT sent in the Authorization header is not valid. This can happen because the JWT has expired, has an invalid signature, or was issued for a different project. Returned with HTTP 401.
bad_oauth_callback Bad OAuth Callback The OAuth callback from the OAuth provider did not include all the required attributes, indicating an issue with the OAuth provider or its configuration. Returned with HTTP 400.
bad_oauth_state Bad OAuth State The OAuth state (data echoed back by the OAuth provider) is not in the correct format, usually indicating a bug in the client-side OAuth implementation. Returned with HTTP 400.
captcha_failed Captcha Failed The captcha challenge, provided as part of the request, could not be verified with the configured captcha provider. Returned with HTTP 400.
conflict Conflict A general database conflict occurred, such as concurrent requests racing to modify the same resource. Retrying the request usually resolves it. Returned with HTTP 409.
email_address_invalid Email Address Invalid The email address provided is not valid according to the RFC-defined format the Auth server accepts. Returned with HTTP 400.
email_address_not_authorized Email Address Not Authorized Emails sent from the project are restricted to members of the organization, usually because the default (shared) SMTP service is being used. Returned with HTTP 422.
email_conflict_identity_not_deletable Email Conflict Identity Not Deletable Unlinking this identity would create an email address conflict with another user, so the identity cannot be deleted. Returned with HTTP 422.
email_conflict_login Email Conflict Login Attempted to authenticate via a login flow that requires an email address, but a different login method was already used with the same email address for that user. Returned with HTTP 400.
email_exists Email Exists The email address already exists in the system, usually when trying to sign up or update a user to an email that's in use by another account. Returned with HTTP 422.
email_not_confirmed Email Not Confirmed Signing in is not allowed because the user's email address has not been confirmed yet. Prompt the user to check their inbox, or resend the confirmation email. Returned with HTTP 400.
email_provider_disabled Email Provider Disabled Signups are disabled for email and password, so a request to create an account with email/password was rejected. Returned with HTTP 422.
flow_state_expired Flow State Expired The PKCE flow state to which the API request relates has expired, usually because too much time passed between starting the flow and completing it. The user should sign in again. Returned with HTTP 403.
flow_state_not_found Flow State Not Found The PKCE flow state to which the API request relates no longer exists, usually because it already completed or was cleaned up. The user should restart the sign-in flow. Returned with HTTP 404.
hook_payload_invalid_content_type Hook Payload Invalid Content Type The payload sent to a configured Auth hook does not have the expected content type. Returned with HTTP 500.
hook_payload_over_size_limit Hook Payload Over Size Limit The payload the Auth server tried to send to a configured hook exceeds the maximum allowed size limit. Returned with HTTP 500.
hook_timeout Hook Timeout A configured Auth hook could not be reached within the maximum time allocated for it. Returned with HTTP 500.
hook_timeout_after_retry Hook Timeout After Retry A configured Auth hook could not be reached even after retrying, within the maximum allowed time. Returned with HTTP 500.
identity_already_exists Identity Already Exists The identity to which the API call relates is already linked to a user, usually raised when trying to link an already-linked OAuth identity. Returned with HTTP 422.
identity_not_found Identity Not Found The identity to which the API call relates does not exist, for example when trying to unlink an identity that was already unlinked. Returned with HTTP 404.
insufficient_aal Insufficient AAL To perform this action, the user needs to have a higher Authenticator Assurance Level, meaning they must solve an MFA challenge first. Returned with HTTP 401.
invalid_credentials Invalid Credentials The login credentials, or the combination of credentials and grant type, are not recognized. Returned with HTTP 400; this is the most common error users see when a password is wrong or the account doesn't exist.
invite_not_found Invite Not Found The invite to which the API request relates has either expired or already been used. Returned with HTTP 400.
manual_linking_disabled Manual Linking Disabled Calling the linkIdentity() API is not enabled on the Auth server, since manual linking is an opt-in feature. Returned with HTTP 422.
mfa_challenge_expired MFA Challenge Expired Responding to an MFA challenge should happen within a fixed time period, and this challenge has expired. Returned with HTTP 422.
mfa_factor_name_conflict MFA Factor Name Conflict MFA factors for a single user should not have the same friendly name, and a conflicting name was supplied when enrolling a new factor. Returned with HTTP 422.
mfa_factor_not_found MFA Factor Not Found The MFA factor to which the API request relates no longer exists, typically because it was unenrolled. Returned with HTTP 404.
mfa_ip_address_mismatch MFA IP Address Mismatch The enrollment process for MFA factors must begin and end with the same IP address, and a mismatch was detected. Returned with HTTP 422.
mfa_phone_enroll_disabled MFA Phone Enroll Disabled Enrollment of new phone-based MFA factors is disabled on the Auth server. Returned with HTTP 422.
mfa_phone_number_taken MFA Phone Number Taken A phone number given for phone-based MFA enrollment is already associated with another user's MFA factor. Returned with HTTP 422.
mfa_phone_verify_disabled MFA Phone Verify Disabled Login via phone-based MFA factors, and verification of new phone factors, is disabled on the Auth server. Returned with HTTP 422.
mfa_totp_enroll_disabled MFA TOTP Enroll Disabled Enrollment of new TOTP-based MFA factors is disabled on the Auth server. Returned with HTTP 422.
mfa_totp_verify_disabled MFA TOTP Verify Disabled Login via TOTP-based MFA factors, and verification of new TOTP factors, is disabled on the Auth server. Returned with HTTP 422.
mfa_verification_failed MFA Verification Failed The MFA challenge could not be verified, for example because the TOTP code was wrong. Returned with HTTP 422.
mfa_verification_rejected MFA Verification Rejected A custom MFA verification hook rejected this attempt to verify an MFA factor. Returned with HTTP 422.
mfa_verified_factor_exists MFA Verified Factor Exists A verified phone-based MFA factor already exists for the user; only one verified factor of this type is allowed per user. Returned with HTTP 422.
mfa_webauthn_credential_not_found MFA WebAuthn Credential Not Found The WebAuthn credential referenced in the request could not be found for this user's MFA factor. Returned with HTTP 404.
mfa_webauthn_enroll_disabled MFA WebAuthn Enroll Disabled Enrollment of new WebAuthn-based MFA factors is disabled on the Auth server. Returned with HTTP 422.
mfa_webauthn_verify_disabled MFA WebAuthn Verify Disabled Login via WebAuthn-based MFA factors, and verification of new WebAuthn factors, is disabled on the Auth server. Returned with HTTP 422.
no_authorization No Authorization This HTTP request requires an Authorization header, which was not sent. Returned with HTTP 401.
not_admin Not Admin The user accessing the admin API is not an admin, i.e. the service_role key was not used in the Authorization header. Returned with HTTP 403.
oauth_provider_not_supported OAuth Provider Not Supported Using an OAuth provider that is disabled on the Auth server. Enable the provider in the project's Auth settings if it should be available. Returned with HTTP 400.
otp_disabled OTP Disabled Signing in with OTPs, such as magic links or email OTPs, is disabled on the Auth server. Returned with HTTP 422.
otp_expired OTP Expired The one-time password (magic link or email/SMS OTP) used for this sign-in attempt has expired. Returned with HTTP 403.
over_email_send_rate_limit Over Email Send Rate Limit Too many emails have been sent to this email address; the client should wait before requesting another one. Returned with HTTP 429.
over_request_rate_limit Over Request Rate Limit Too many requests have been sent by this client, identified by IP address, in a short period of time. Returned with HTTP 429.
over_sms_send_rate_limit Over SMS Send Rate Limit Too many SMS messages have been sent to this phone number; the client should wait before requesting another one. Returned with HTTP 429.
phone_exists Phone Exists The phone number already exists in the system, usually when trying to sign up or update a user to a phone number that's in use by another account. Returned with HTTP 422.
phone_not_confirmed Phone Not Confirmed Signing in is not allowed because the user's phone number has not been confirmed yet. Returned with HTTP 400.
phone_provider_disabled Phone Provider Disabled Signups are disabled for phone and password, so a request to create an account with a phone number and password was rejected. Returned with HTTP 422.
provider_disabled Provider Disabled The OAuth or SSO provider used for the sign-in request is disabled on the Auth server. Enable it in the project's Auth settings if it should be available. Returned with HTTP 422.
provider_email_needs_verification Provider Email Needs Verification A user that opted-in to linking their account with an OAuth provider needs their email verified before the identity is linked, and a verification email was just sent. Returned with HTTP 400.
provider_max_identity_limit_exceeded Provider Max Identity Limit Exceeded The user has reached the maximum number of identities that can be linked from a single OAuth or SSO provider. Returned with HTTP 422.
reauthentication_needed Reauthentication Needed The user needs to reauthenticate to perform a sensitive action, such as changing their password. Returned with HTTP 422.
reauthentication_not_valid Reauthentication Not Valid Verifying a reauthentication failed because the confirmation code supplied is incorrect. Returned with HTTP 400.
request_timeout Request Timeout Processing the request took too long and it was aborted; the client should retry the request. Returned with HTTP 504.
request_timeout_after_retry Request Timeout After Retry The request timed out after the Auth server retried it internally; the client should retry the original request. Returned with HTTP 504.
same_password Same Password A user, when changing their password, must use a different password than the one currently in use. Returned with HTTP 422.
saml_assertion_no_email SAML Assertion No Email The SAML assertion received from the identity provider did not contain an email address attribute expected by the Auth server. Returned with HTTP 400.
saml_assertion_no_user_id SAML Assertion No User ID The SAML assertion received from the identity provider did not contain the user ID (NameID) attribute expected by the Auth server. Returned with HTTP 400.
saml_entity_id_mismatch SAML Entity ID Mismatch Updating the SAML metadata for a provider must not change its entity ID; register a new provider instead. Returned with HTTP 422.
saml_idp_already_exists SAML IdP Already Exists The SAML identity provider being added has already been added to the project. Returned with HTTP 422.
saml_idp_not_found SAML IdP Not Found The SAML identity provider to which the API request relates could not be found, usually because it was removed. Returned with HTTP 404.
saml_metadata_fetch_failed SAML Metadata Fetch Failed The SAML metadata for the identity provider could not be fetched from the provided metadata URL. Returned with HTTP 500.
saml_provider_disabled SAML Provider Disabled Using Enterprise SSO with SAML 2.0 is not enabled on the Auth server. Returned with HTTP 403.
saml_provider_not_found SAML Provider Not Found The SAML provider to which the request relates could not be found in the project. Returned with HTTP 404.
saml_relay_state_expired SAML Relay State Expired The SAML relay state to which the API request relates has expired; the user should restart the SAML sign-in flow. Returned with HTTP 403.
saml_relay_state_not_found SAML Relay State Not Found The SAML relay state to which the API request relates no longer exists, usually because the SAML login flow already completed. Returned with HTTP 404.
saml_sso_provider_already_exists SAML SSO Provider Already Exists A SAML identity provider with these parameters (such as the same metadata URL) already exists in the project. Returned with HTTP 422.
session_not_found Session Not Found The session to which the API request relates no longer exists, for example because the user signed out or the session expired and was pruned. Returned with HTTP 403.
signup_disabled Signup Disabled Sign ups (new account creation) are disabled on the Auth server, typically because the project has disabled public signups. Returned with HTTP 422.
single_identity_not_deletable Single Identity Not Deletable Every user must have at least one identity attached, so deleting the last remaining identity for a user is not allowed. Returned with HTTP 422.
sms_send_failed SMS Send Failed Sending an SMS message failed, usually due to a misconfigured or failing SMS sending provider. Returned with HTTP 500.
sso_domain_already_exists SSO Domain Already Exists Only one SSO domain can be registered per SSO identity provider, and the domain being added already belongs to another provider. Returned with HTTP 422.
sso_provider_not_found SSO Provider Not Found No SSO provider was found matching the parameters of the sign-in request, such as the domain. Returned with HTTP 404.
too_many_enrolled_mfa_factors Too Many Enrolled MFA Factors A user can only have a fixed number of enrolled MFA factors, and this limit has been reached. Returned with HTTP 422.
unexpected_audience Unexpected Audience The request's X-JWT-AUD claim does not match the JWT's audience, usually because a project is being used with the wrong JWT audience configuration. Returned with HTTP 400.
unexpected_failure Unexpected Failure The Auth service is degraded or has a bug. Returned with HTTP 500; retry the request and check the Supabase status page if it persists.
user_already_authenticated User Already Authenticated A user that is already signed in attempted to re-link an identity that's already linked to their account. Returned with HTTP 422.
user_already_exists User Already Exists A user with this information (such as email or phone) cannot be created again as one already exists. Returned with HTTP 422.
user_banned User Banned The user to which the API request relates has an active ban and should not be allowed to sign in. Returned with HTTP 403.
user_not_found User Not Found The user to which the API request relates no longer exists, typically because it was deleted after the request was made. Returned with HTTP 404.
validation_failed Validation Failed The parameters provided to the API method are not in the expected format. Returned with HTTP 422; check the request body against the endpoint's documented schema.
weak_password Weak Password A user is signing up or updating their password without meeting the project's configured password strength criteria. Returned with HTTP 422.