How to fix invalid_credentials: Login credentials are incorrect in Supabase

SupabaseBEGINNERHIGHUpdated Dec 29, 2025· 234 views

This error occurs when Supabase Auth fails to authenticate a user due to invalid email or password. The error intentionally doesn't distinguish between wrong passwords and non-existent users for security reasons.

Quick fix

Fixes invalid_credentials

const email = userInput.email.trim().toLowerCase();
const password = userInput.password;

const { data, error } = await supabase.auth.signInWithPassword({
  email,
  password,
});
  1. Verify the email and password are correct
  2. Enable a password reset flow
  3. Check if user exists in your users table
  4. Check authentication method used at signup
supabase — error
const email = userInput.email.trim().toLowerCase();
const password = userInput.password;
const { data, error } = await supabase.auth.signInWithPassword({
  email,
  password,
});
invalid_credentials: Login credentials are incorrect

What this error means

When you attempt to sign in to a Supabase application using the `signInWithPassword()` method, the authentication system verifies the provided email and password against records in the Supabase Auth database. The "invalid_credentials" error is returned when the authentication fails. For security purposes, Supabase does not distinguish between two scenarios: (1) a user tried to log in with a correct email but wrong password, or (2) a user tried to log in with an email that doesn't exist in the system. This is intentional—it prevents attackers from using login attempts to enumerate valid email addresses.

Typical symptoms

  • SignIn API call returns 'invalid_credentials' error
  • Login form displays generic 'credentials are incorrect' message
  • Users cannot authenticate even with what they believe is correct credentials
  • No additional error details to distinguish password vs. account issues

Common causes

  1. User entered an incorrect password for an existing account
  2. User entered an email address that is not registered in the system
  3. User's email contains leading/trailing whitespace that wasn't trimmed
  4. User entered email with different case sensitivity than registered
  5. User account exists but was registered with a different authentication method (e.g., GitHub OAuth)

How to fix "invalid_credentials: Login credentials are incorrect"

1Verify the email and password are correct

Double-check the email address and password for typos. Common mistakes include:
- Extra spaces before/after the email
- Caps Lock accidentally enabled
- Password with special characters typed incorrectly

Trim whitespace from inputs in your code:

javascript
const email = userInput.email.trim().toLowerCase();
const password = userInput.password;

const { data, error } = await supabase.auth.signInWithPassword({
  email,
  password,
});
2Enable a password reset flow

If the user has forgotten their password, provide a password reset option. This is the most user-friendly approach:

javascript
const { data, error } = await supabase.auth.resetPasswordForEmail(email, {
  redirectTo: `${window.location.origin}/auth/callback`,
});

if (error) console.error('Reset error:', error);
else alert('Check your email for password reset link');

The user will receive a reset link in their email to create a new password.

3Check if user exists in your users table

If you need to distinguish between wrong password and non-existent user, query your users table:

javascript
// After catching 'invalid_credentials' error
const { data: users } = await supabase
  .from('users') // or your users table name
  .select('id')
  .eq('email', email)
  .single();

if (!users) {
  // User does not exist in system
  console.log('Email not found - user needs to sign up');
} else {
  // User exists but password is wrong
  console.log('Email exists - password is incorrect');
}

Note: This only works if you store user emails in a custom users table. Supabase Auth itself doesn't expose this information.

4Check authentication method used at signup

If a user originally signed up with OAuth (GitHub, Google, etc.), they cannot log in with a password. Verify their signup method:

javascript
// Get current session to see linked identities
const { data: { user } } = await supabase.auth.getUser();

console.log(user?.identities); // Shows OAuth providers used

// If they signed up with GitHub but try password login, explain:
// "You signed up using GitHub. Please sign in with GitHub instead."
5Verify Supabase project credentials

Ensure your Supabase client is initialized with correct credentials:

javascript
import { createClient } from '@supabase/supabase-js';

const supabase = createClient(
  'https://YOUR_PROJECT_ID.supabase.co',
  'YOUR_PUBLIC_ANON_KEY'
);

If credentials are mismatched or pointing to the wrong project, all auth calls will fail. Check your .env file matches your Supabase project settings.

Advanced notes

By design, Supabase does not differentiate between "wrong password" and "user does not exist" in the error response. This security-first approach prevents account enumeration attacks where attackers could discover valid email addresses in your user base.

If your application requires distinguishing these cases, you'll need to implement additional logic by querying your custom users table after catching the error. However, be mindful of rate limiting to prevent attackers from using this as a reconnaissance tool.

For self-hosted Supabase deployments, ensure your JWT secret is properly configured (at least 32 characters, using alphanumeric characters). Malformed JWT secrets can cause authentication issues even with correct credentials.

Frequently asked questions

What does "invalid_credentials" mean?
When you attempt to sign in to a Supabase application using the signInWithPassword() method, the authentication system verifies the provided email and password against records in the Supabase Auth database. The "invalid_credentials" error is returned when the authentication fails. For security purposes, Supabase does not distinguish between two scenarios: (1) a user tried to log in with a correct email but wrong password, or (2) a user tried to log in with an email that doesn't exist in the system.
How do I fix "invalid_credentials"?
This error occurs when Supabase Auth fails to authenticate a user due to invalid email or password. The error intentionally doesn't distinguish between wrong passwords and non-existent users for security reasons.
What causes "invalid_credentials"?
User entered an incorrect password for an existing account User entered an email address that is not registered in the system User's email contains leading/trailing whitespace that wasn't trimmed
Is the "invalid_credentials" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading