Error map
invalid two-factor code Two-factor (TOTP) code invalid / Invalid verification code (authenticator app time drift)
Authentication · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (7)
AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x
The app client has a client secret, so every request needs a SECRET_HASH — and it’s missing or computed wrongly.
AWS Cognito: NotAuthorizedException: Incorrect username or password
Cognito rejected the sign-in — wrong credentials, a disabled user, an auth flow not enabled on the app client, or an expired refr…
bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required
bcrypt.compare/hash received undefined — the password field or stored hash wasn’t passed.
Azure AD (Entra ID): AADSTS50076 / AADSTS50079 — multi-factor authentication required
A Conditional Access policy requires MFA, but the sign-in flow (often a script, legacy client or ROPC password grant) can’t compl…
NotBeforeError: jwt not active (nbf claim in the future)
The token’s nbf (not before) time is in the future for the verifying server — usually clock skew between servers.
AWS Cognito: UserNotConfirmedException: User is not confirmed.
The user signed up but hasn’t confirmed their account (email/SMS code), so Cognito won’t let them sign in.
Kerberos: Clock skew too great (KRB_AP_ERR_SKEW)
The client’s clock differs from the domain controller’s by more than 5 minutes, so Kerberos tickets are rejected.
Two steps away (20)
OAuth 2.0 Error: invalid_client
The OAuth server couldn’t authenticate your application — wrong client ID/secret, wrong auth method, or the client doesn’t exist…
{"message":"Missing Authentication Token"} / No authorization token was found
The request reached a protected endpoint without credentials — or, on AWS API Gateway, it hit a path/method that doesn’t exist.
WebAuthn / Passkeys: NotAllowedError: The operation either timed out or was not allowed
The browser refused the passkey/WebAuthn ceremony — the user cancelled, it timed out, no matching credential, or the call wasn’t…
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
API Error: Missing required parameter (parameter_missing / "x" is required)
The API rejected the request because a field it requires — in the query string, path, headers or JSON body — wasn’t sent or was e…
AADSTS50055: The password is expired
The user’s password expired under the tenant/on-prem password policy and must be changed before signing in.
WebAuthn: SecurityError: The relying party ID is not a registrable domain suffix of, nor equal to the current domain
The rp.id in the WebAuthn options doesn’t match the page’s domain (or a parent domain), so the browser rejects it.
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
fatal: Authentication failed for 'https://github.com/x/y.git/'
HTTPS authentication to the Git host failed — wrong or expired credentials, or a password used where a token is required.
Host key verification failed. fatal: Could not read from remote repository.
SSH doesn’t trust the server’s host key — first connection in a non-interactive environment, or the key changed.
JWT Expired / Invalid Token
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rejects it (usually wit…
invalid_token: The access token is invalid (JsonWebTokenError: invalid signature / jwt malformed)
A token was sent but the server couldn’t verify it — bad signature, malformed, revoked, or issued for another audience or environ…
JsonWebTokenError: jwt must be provided
jwt.verify() was called with an empty value — the token never reached the server code.
SES MessageRejected: Email address is not verified. The following identities failed the check in region
SES refused to send because the From address/domain isn’t verified — or the account is still in the SES sandbox, where recipients…
Firebase Auth: auth/invalid-credential (auth/wrong-password, auth/user-not-found, auth/invalid-login-credentials)
Firebase rejected the email/password sign-in — wrong password, no such user, or a provider credential that’s malformed/expired.
Supabase Auth: AuthApiError: Email not confirmed
The account exists, but email confirmation is enabled and the user hasn’t clicked the confirmation link.
LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e
Active Directory/LDAP rejected the bind — the data code tells you why (52e wrong password, 525 user not found, 532 password expir…
SAML: Invalid SAML response — signature validation failed / audience mismatch / response expired (NotOnOrAfter)
The service provider rejected the IdP’s SAML assertion — wrong certificate, Audience/Entity ID mismatch, ACS URL mismatch, or clo…
Map another error
Popular: 403500400TypeErrorCritical error0xC000007BNullPointerException404