Error map
SAML response invalid SAML: Invalid SAML response — signature validation failed / audience mismatch / response expired (NotOnOrAfter)
Authentication · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (7)
Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials)
Firebase rejected the email/password sign-in — wrong password, no such user, or a provider credential that’s malformed/expired.
AWS Cognito: NotAuthorizedException: Incorrect username or password
Cognito rejected the sign-in — wrong credentials, a disabled user, an auth flow not enabled on the app client, or an expired refr…
AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x
The app client has a client secret, so every request needs a SECRET_HASH — and it’s missing or computed wrongly.
bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required
bcrypt.compare/hash received undefined — the password field or stored hash wasn’t passed.
AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application
The signed-in user belongs to another tenant (or is a personal Microsoft account) and isn’t a guest in the app’s tenant.
AWS Cognito: UserNotConfirmedException: User is not confirmed.
The user signed up but hasn’t confirmed their account (email/SMS code), so Cognito won’t let them sign in.
Kerberos: Clock skew too great (KRB_AP_ERR_SKEW)
The client’s clock differs from the domain controller’s by more than 5 minutes, so Kerberos tickets are rejected.
Two steps away (20)
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
JWT Expired / Invalid Token
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rejects it (usually wit…
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
API Error: Invalid API Key / Incorrect API key provided
The API didn’t recognise the key sent with the request — it’s wrong, revoked, from another environment, or sent in the wrong plac…
OAuth 2.0 Error: invalid_client
The OAuth server couldn’t authenticate your application — wrong client ID/secret, wrong auth method, or the client doesn’t exist…
{"message":"Missing Authentication Token"} / No authorization token was found
The request reached a protected endpoint without credentials — or, on AWS API Gateway, it hit a path/method that doesn’t exist.
Two-factor (TOTP) code invalid / Invalid verification code (authenticator app time drift)
The 6-digit authenticator code is rejected — usually because the phone’s or server’s clock is off, or the secret was enrolled twi…
API Error: Missing required parameter (parameter_missing / "x" is required)
The API rejected the request because a field it requires — in the query string, path, headers or JSON body — wasn’t sent or was e…
AADSTS50055: The password is expired
The user’s password expired under the tenant/on-prem password policy and must be changed before signing in.
WebAuthn / Passkeys: NotAllowedError: The operation either timed out or was not allowed
The browser refused the passkey/WebAuthn ceremony — the user cancelled, it timed out, no matching credential, or the call wasn’t…
AADSTS50126: Error validating credentials due to invalid username or password
Microsoft Entra ID (Azure AD) rejected the sign-in because the username or password is wrong — or the flow can’t use passwords fo…
AADSTS65001: The user or administrator has not consented to use the application
The app needs permissions that haven’t been granted for this user or tenant.
AADSTS90002: Tenant 'x' not found
The tenant ID or domain in the authority URL doesn’t exist — or isn’t in the cloud you’re calling (public vs government/China).
SES MessageRejected: Email address is not verified. The following identities failed the check in region
SES refused to send because the From address/domain isn’t verified — or the account is still in the SES sandbox, where recipients…
WebAuthn: SecurityError: The relying party ID is not a registrable domain suffix of, nor equal to the current domain
The rp.id in the WebAuthn options doesn’t match the page’s domain (or a parent domain), so the browser rejects it.
Supabase Auth: AuthApiError: Email not confirmed
The account exists, but email confirmation is enabled and the user hasn’t clicked the confirmation link.
NotBeforeError: jwt not active (nbf claim in the future)
The token’s nbf (not before) time is in the future for the verifying server — usually clock skew between servers.
LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e
Active Directory/LDAP rejected the bind — the data code tells you why (52e wrong password, 525 user not found, 532 password expir…
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException