Error Codes — Abrova Auth

Every error code Abrova Auth returns, with its HTTP status, what it means and what your app should do, plus the codes the SDKs add themselves (network errors, not configured, cancelled).

Error codes.

Every failed call has a stable code. Show your users messages based on the code, in their language. The message that comes with it is an English hint for developers: it never contains a secret or an e-mail address, and it may change.

How errors arrive#

SDK	Error type	Code field
Flutter	AbrovaAuthException (AbrovaProviderAlreadyLinkedException for linking)	code, compare with AbrovaAuthErrorCode
iOS	AbrovaAuthError	code, for example .invalidCredentials
Android	AbrovaAuthException	code, compare with AbrovaAuthErrorCode
Web, React Native	AbrovaAuthError (check with isAbrovaAuthError)	code, for example 'INVALID_CREDENTIALS'

Over a rate limit, the error also carries the wait: retryAfterSec (iOS, Android, Web, React Native) or retryAfter (Flutter).

Codes from Abrova Auth#

Code	HTTP	Meaning	What to do
INVALID_INPUT	400	A field is missing or malformed: e-mail, phone format, a nonce shorter than 16 characters, a redirectUrl that is not one of your link addresses.	Fix the request. A fields object may name the field.
INVALID_API_KEY	401	The API key is unknown.	Use the public key from Abrova Auth › Setup.
PRODUCT_DISABLED	403	Abrova Auth is not turned on for the project.	Turn it on under Settings › Products.
METHOD_DISABLED	403	This sign-in method is off for the project.	Turn it on, or hide the button (use getMethods).
NOT_CONFIGURED	400 / 503	The method is on but not set up (no Apple or Google ids, no Telegram bot), or e-mail delivery is unavailable (503).	Finish the setup in the Console. For 503, try again later.
INVALID_CREDENTIALS	401	Wrong e-mail or password, or a wrong or expired Telegram code.	Ask the user to check and try again.
EMAIL_TAKEN	409	Another user has this e-mail.	Offer sign-in or password reset.
EMAIL_NOT_VERIFIED	403	The project requires a verified e-mail and this one is not verified.	Ask the user to open the verification e-mail; offer to send it again.
WEAK_PASSWORD	400	The password is too short, longer than 128 characters, or very common.	Ask for a longer, less common password.
INVALID_ID_TOKEN	401	The Apple or Google ID token is not valid for this project: wrong app id, expired, older than 10 minutes, or the nonce does not match.	Check the ids in the Console and the nonce handling.
NONCE_REUSED	401	This nonce was already used for a sign-in.	Create a new nonce for every sign-in.
PROVIDER_ALREADY_LINKED	409	Linking: the Apple or Google account belongs to another user.	Offer to sign in to that account instead.
TOKEN_INVALID	400 / 401	An e-mail link token is invalid, used or expired (400), or the refresh token is unknown (401).	Ask for a new link, or sign in again.
SESSION_EXPIRED	401	The session ran out (60 days unused, or 1 year old).	The SDK signs out. Ask the user to sign in.
SESSION_REVOKED	401	The session was ended: sign-out everywhere, password reset, or a reused refresh token.	The SDK signs out. Ask the user to sign in.
USER_DISABLED	403	You disabled this user in the Console.	The SDK signs out. Tell the user the account is disabled.
UNAUTHENTICATED	401	The call needs a signed-in user and there is none (or the access token is not valid).	Sign in first.
RATE_LIMITED	429	Too many attempts, or the daily limit of new anonymous users.	Wait retryAfterSec, then try again.
MAU_LIMIT	403	This month's free 1,000 monthly active users are used up, the wallet has no balance to pay for more, and this user is new this month.	Show a friendly message. Top up the wallet to let new users in.
LIMIT_REACHED	403	A feature needs a wallet balance (for example the usage insights API). Not returned by sign-in calls.	Top up the wallet.
INTERNAL	500 / 503	Something went wrong on the Abrova side.	Try again later.

Codes the SDKs add#

These come from the SDK, not from Abrova Auth: there was no answer, or the problem is on the device.

Code	SDK	Meaning
NETWORK_ERROR	All	No answer (offline, timeout). The session is kept; try again.
UNKNOWN	Flutter, Web, React Native	The answer could not be read.
INVALID_RESPONSE	iOS, Android	The answer could not be read.
SDK_NOT_CONFIGURED	iOS, Android	configure() was not called first.
NOT_SIGNED_IN	iOS, Android	strictTokenProvider or a signed-in call with nobody signed in.
CANCELED	iOS	The user closed the Apple sign-in sheet.

Errors that end the session#

When a renewal fails with SESSION_EXPIRED, SESSION_REVOKED, TOKEN_INVALID or USER_DISABLED, the SDK clears the session on the device and your auth state listener receives null. Send the user to your sign-in screen there. Every other error, including NETWORK_ERROR, keeps the session.