Supabase Auth invalid_credentials

What it means in plain English

Supabase's Auth error-code table defines invalid_credentials as: Login credentials or grant type not recognized.

Errors from the Supabase Auth API are AuthApiError. Supabase says they always have a code property that identifies the error the server returned, and a status property with the HTTP status code. Supabase says to use isAuthApiError instead of instanceof checks.

Other codes in the same table are different problems. email_not_confirmed means signing in is not allowed because the email address is not confirmed. user_not_found means the user no longer exists. over_request_rate_limit means too many requests came from this client's IP address.

Likely causes

• The email and password, or other login credentials, were not recognized.
• The request used a grant type Supabase Auth did not recognize.
• The real code is a different one, such as email_not_confirmed, and the app is reading only the message text.

How to fix it, step by step

1. Read error.code on the error, not the message text. Supabase says to always use error.code and error.name to identify errors, not string matching on messages, and not to rely only on HTTP status codes.
2. If the code is invalid_credentials, the credentials or the grant type were not recognized. Check the email and password the form sends.
3. If the code is email_not_confirmed, the address is not confirmed. See Supabase email not confirmed.
4. If the code is email_provider_disabled, Supabase says signups are disabled for email and password. If it is signup_disabled, sign ups are disabled on the server. See Supabase signups disabled.
5. If the code is over_request_rate_limit, stop retrying and see Supabase over_request_rate_limit.

How to check it worked

• The sign-in call returns a session and no error.
• If it still fails, error.code names the next thing to fix, and it is not invalid_credentials.

Sources

• https://supabase.com/docs/guides/auth/debugging/error-codes (opens in a new tab)