auth.signin

A sign-in with the wrong email or password

Profile

Errors

Raised with

fail()

Status

401

Message

generic

Writes

security.signin

View as Markdown

Auth intents

Example

return fail('auth.signin');

The caller gets

Terminal

HTTP 401

{
  "ok": false,
  "error": "Wrong email or password.",
  "code": "auth.signin"
}

And it writes security.signin

{
  "intent": "security.signin",
  "level": "warn",
  "alert": false,
  "message": "Wrong email or password.",
  "data": {
    "intent": "auth.signin"
  },
  "time": "2026-10-09T12:00:00.000Z"
}

Choosing between neighbours

Find the row that describes your case, and use the intent on the right.

If it is
Use
A sign-in with the wrong email or password
auth.signin this page
A bad API token, webhook signature or preview secret
auth.invalid
A wrong email or password at sign-in
rather than auth.invalid
auth.signin this page

Connections

Declared in the registry, both directions. Where an intent is used in your own code is something check and the gallery see; this site has no app code.

Built from
status.unauthorized
Writes
security.signin

For registry authors

Starter intents. These are the intents prongs add errors puts in your registry, raised with fail(). Change the messages to suit your app, and the statuses through the status.* intents they are built from.

The entry prongs add errors writes into your registry. Change the message here, or the status through its status.* ref.

'auth.signin': {
  kind: 'semantic',
  description: 'A sign-in with the wrong email or password',
  refs: ['status.unauthorized'],
  binding: {
    publicMessage: 'Wrong email or password.',
    expose: 'generic',
    logs: 'security.signin',
  },
  notFor: [
    {
      context: 'a bad API token, webhook signature or preview secret',
      instead: 'auth.invalid',
    },
  ],
},