401 Unauthorized

Incorrect email or password

Code

invalid_credentials

Status

401 Unauthorized

Type

https://errors.clavian.io/invalid-credentials

What it means

The sign-in did not succeed. The answer, and the time it takes, are the same for an unknown account, a wrong password and a malformed username, so it never says which it was.

What to do

Show one message for every case, as the title does, and let the person try again. Repeated attempts are limited, with rate_limited.

Example

The API answers with status 401 and this body, as application/problem+json. A detail may be added, saying what went wrong this time; it is for people, and changes.

{
  "type": "https://errors.clavian.io/invalid-credentials",
  "title": "Incorrect email or password",
  "status": 401,
  "code": "invalid_credentials",
  "requestId": "req_01k5znw4hmfay8vvr14d2pf2db"
}

Endpoints that return it

From the OpenAPI document, every endpoint that names it among its answers:

• POST /v1/station/sign-in/passwordSign a player in at a kiosk with an email address or username and a password