Reference
Error codes
Every error response has the shape:
{
"error": {
"code": "WISE_LINK_EXPIRED",
"message": "Sign-in link has expired",
"details": { ... }
}
} All codes
| Code | HTTP | Meaning |
|---|---|---|
| BAD_REQUEST | 400 | Validation failed (zod issues in details). |
| UNAUTHORIZED | 401 | Missing or invalid session cookie / API key. |
| FORBIDDEN | 403 | API key missing the required scope. |
| NOT_FOUND | 404 | Route or resource not found. |
| CONFLICT | 409 | Idempotency-Key reused with different body. |
| RATE_LIMITED | 429 | Per-key or per-IP throttle. Honour Retry-After. |
| INTERNAL | 500 | Server bug on our side. reqId in your logs for support. |
| EMAIL_TAKEN | 409 | Signup: email already registered (or different provider). |
| INVALID_CREDENTIALS | 401 | Login: email or password wrong. Constant-time compare on our side. |
| WISE_LINK_EXPIRED | 410 | Wise-link token past its 15-min TTL. Request a new one. |
| WISE_LINK_INVALID | 400 | Token missing, mangled, or already consumed. |
| OAUTH_PROVIDER_DISABLED | 501 | That OAuth provider is not configured on this instance. |
| OAUTH_CALLBACK_FAILED | 400 | OAuth handshake failed (bad state, expired code, mismatched audience). |
| ACCOUNT_SUSPENDED | 403 | Account.suspendedAt is set. Contact support to reinstate. |
| EMAIL_NOT_VERIFIED | 403 | Some flows require a verified email. Check your inbox or hit /auth/wise-link. |
Rules of thumb
- 4xx = your side. Fix the request; do NOT retry blindly.
- 5xx = our side. Retry with exponential backoff; include Idempotency-Key so retries don't double-charge.
- Every response body carries a
reqIdinerror.details.reqIdwhen relevant — quote it in support tickets so we can pull the exact trace.