auth.invalid

A wrong credential: a bad API token, webhook signature or preview secret

Profile

Errors

Raised with

fail()

Status

401

Message

generic

Writes

security.token

View as Markdown

Auth intents

Example

return fail('auth.invalid', 'Preview secret did not match.');

The caller gets

Terminal

HTTP 401

{
  "ok": false,
  "error": "Invalid credentials.",
  "code": "auth.invalid"
}

And it writes security.token

{
  "intent": "security.token",
  "level": "warn",
  "alert": false,
  "message": "Preview secret did not match.",
  "data": {
    "intent": "auth.invalid"
  },
  "time": "2026-10-09T12:00:00.000Z"
}

Choosing between neighbours

Find the row that describes your case, and use the intent on the right.

If it is
Use
A wrong credential: a bad API token, webhook signature or preview secret
auth.invalid this page
A wrong email or password at sign-in
auth.signin
A bad API token, webhook signature or preview secret
rather than auth.signin
auth.invalid this page

Connections

Declared in the registry, both directions. Where an intent is used in your own code is something check and the gallery see; this site has no app code.

Built from
status.unauthorized
Writes
security.token

For registry authors

Starter intents. These are the intents prongs add errors puts in your registry, raised with fail(). Change the messages to suit your app, and the statuses through the status.* intents they are built from.

The entry prongs add errors writes into your registry. Change the message here, or the status through its status.* ref.

'auth.invalid': {
  kind: 'semantic',
  description: 'A wrong credential: a bad API token, webhook signature or preview secret',
  refs: ['status.unauthorized'],
  binding: {
    publicMessage: 'Invalid credentials.',
    expose: 'generic',
    logs: 'security.token',
  },
  notFor: [
    {
      context: 'a wrong email or password at sign-in',
      instead: 'auth.signin',
    },
  ],
},