Invalid login credentials
Supabase couldn’t match that email and password to an account that signs in with a password, and it deliberately doesn’t say which part was wrong.
Also appears as
- {"code":"invalid_credentials","message":"Invalid login credentials"}
Prompt to fix it
Signing in with email and password fails with "Invalid login credentials". Check the whole auth flow: does sign-up actually call supabase.auth.signUp instead of only inserting into our own users table, does the app connect to the same Supabase project where the account was created, and could the account be Google or magic-link only, with no password? Fix the real cause, add a working password reset flow with resetPasswordForEmail, and show a friendly "Wrong email or password" message. Don’t reveal whether an email has an account.
Paste into Layerwise or any AI coding tool.
What it means
Supabase Auth returns this one message whether the email has no account, the account has no password, or the password is wrong. That’s deliberate: a more specific message would let anyone test which emails have accounts.
In AI-built apps, the account often doesn’t exist where the app is looking. The sign-up form may have saved the person into the app’s own users or profiles table without ever calling supabase.auth.signUp. Or the app’s environment variables point at a different Supabase project than the one where the account was created.
People who signed up with Google or a magic link have no password, so a password sign-in fails for them too. And when the password is right but the email isn’t confirmed, Supabase says “Email not confirmed” instead, so this message really does mean the email and password didn’t match.
Common causes
- The sign-up form saved the person to a database table but never called
supabase.auth.signUp, so no Auth account exists. - The app points at a different Supabase project, such as a development project, than the one that holds the account.
- The account was created with Google or a magic link and has no password.
- A seed script inserted test users straight into
auth.userswithout a valid password hash. - The password is wrong, often an old one the browser saved during testing.
How to fix it
- Open the Supabase project the app actually uses (match the URL in its environment variables), go to Authentication, then Users, and search for the email.
- If the user is missing, make sure the sign-up form calls
supabase.auth.signUpand handles the error it returns. - If the user signed up with Google or a magic link, sign in that way, or send a password reset with
supabase.auth.resetPasswordForEmail. - For a clean test account, choose Add user, then Create new user in the dashboard, with auto-confirm on.
- In the UI, show “Wrong email or password” with a reset link, and keep the message vague on purpose.
Example fix
const { error } = await supabase.auth.signInWithPassword({ email, password });
if (error?.code === 'invalid_credentials') {
// Same message for an unknown email and a wrong password, on purpose.
setMessage('Wrong email or password.');
} else if (error?.code === 'email_not_confirmed') {
setMessage('Confirm your email first. Check your inbox for the link.');
} else if (error) {
throw error;
}Related errors
All errorsEmail not confirmed
The password was right, but the person hasn’t clicked the confirmation link Supabase emailed at sign-up, so sign-in is blocked.
AuthSessionMissingError: Auth session missing
A Supabase auth call needed a signed-in user, but the client making it had no session, often because it runs on the server without cookies.
supabaseUrl is required
The deployed app created its Supabase client with an empty URL, because the environment variable holding it never made it into the build.
Error 400: redirect_uri_mismatch
Google stopped the sign-in because the return address your app sent isn’t on the OAuth client’s list of approved redirect URIs.
Build with an agent that checks its work
The Layerwise agent clicks through the live preview and reads the console, so it catches errors before you do.