Invalid login credentials
- Supabase Auth
What it means
The email and password did not match an account that can sign in with a password. Supabase deliberately gives the same answer for every reason, so attackers cannot tell which accounts exist.
Why it happens
- The password is wrong, or the account was created with a different email.
- The account was made with a magic link or Google, so it has no password.
- The email was never confirmed (Supabase may say 'Email not confirmed' instead).
How to fix it
- Offer 'forgot password' and a magic-link option next to the password field.
- Check the user in Supabase's Authentication list: how they signed up and whether they are confirmed.
- Keep the vague message for users: it protects their privacy.
Let your AI find the cause
Paste this into Claude Code, Cursor, Lovable or whichever AI built your app. It looks first and changes nothing until you have read the answer.
Users of my Supabase app report 'Invalid login credentials'. Without changing anything yet, tell me which sign-in methods this project offers, how accounts are created, and whether a user who signed up one way can sign in another.