Cannot create a new TOTP for the specified user since the user already has an active TOTP. Users may only have one active TOTP at a time.
The request was blocked by an Ad Blocker. Please disable your ad blocker and try the request again.
The number of user methods registered to the allow list has exceeded the maximum of 500.
The Apple OAuth config was not found.
The key\_length value doesn't match the length of the provided hash.
The project does not have an authorization endpoint configured. Please configure it in the dashboard.
This app bundle ID has not been registered as an allowed app for the Stytch SDK. Please add it here: [https://stytch.com/dashboard/sdk-configuration](https://stytch.com/dashboard/sdk-configuration)
This website has not been registered as an allowed domain for the Stytch SDK. Please add it here: [https://stytch.com/dashboard/sdk-configuration](https://stytch.com/dashboard/sdk-configuration)
The submitted request is invalid.
The credentials used match a different vertical than the one specified in the SDK configuration. Please check if you are using a B2B or B2C project.
You cannot use this endpoint in the live environment until credit card details are added to your account, but you can try the endpoint in the test environment. Once your billing information is verified, this endpoint can be used in live. Your first 5,000 monthly active users are free every month, but collecting this information helps us prevent abuse of the platform. Please go to billing settings to provide billing information.
You can only send magic links to emails matching your project's domain until credit card details are added to your account. Once your billing information is verified, emails can be sent to anyone. Your first 5,000 monthly active users are free every month, but collecting this information helps us prevent abuse of the platform. Please go to billing settings to provide billing information.
Password doesn't meet the API's strength requirements. A password's strength could be tested with the password strength check endpoint.
The number of users passed to bulk migrate password was invalid.
This trusted token profile does not use public key type PEM and cannot have associated PEM files
The default role is implicitly assigned to all members in the project and cannot be explicitly assigned.
Cannot delete an email template that is currently set as a default. Please update or unset the default email template setting before deleting this template.
Cannot delete the last email for a user with a password. This ensures they can complete a password reset.
You cannot delete the last primary factor (email, phone number, crypto wallet) for a user because that would make their account difficult or impossible to recover. If you want to remove the user from your project, delete the user instead.
If you remove this factor, the user will be unable to log in.
Cannot reset user's password using their existing password. This could be because their existing password was part of a data breach or to prevent password squatting. Please reset the password via a session or email reset.
If you want to specify wildcard (`*`) for a resource, do not pass any other actions.
Mobile biometrics can only be used for active users.
Client secret is too long. Please make sure you have the correct value.
You must have a valid CNAME record to enable HTTP-only cookies. Please add a CNAME record to your DNS configuration.
The client is already in a secret rotation flow. Please finish or cancel the current secret rotation flow before starting a new one.
The redirect URL for this client is invalid.
The client is misconfigured. Check application logs for additional details.
The client is not in a secret rotation flow. Please start a secret rotation flow before calling this endpoint.
The redirect URL for this client cannot be localhost. See [https://datatracker.ietf.org/doc/html/rfc8252#section-8.3](https://datatracker.ietf.org/doc/html/rfc8252#section-8.3) for more details.
The redirect URL for this public client uses an 'http' scheme. Only loopback addresses are allowed with 'http' schemes.
The redirect URL for this public client must have a scheme. If you believe this to be in error, please contact [support@stytch.com](mailto:support@stytch.com) for assistance.
The redirect URL for this non-public client must use the 'http' or 'https' schemes.
The redirect URL for this non-public client must use the 'https' scheme. Localhost or loopback addresses are not allowed
Could not parse the biometric signature. The field should be base64 encoded.
The country code allowlist cannot be empty as this will block the project from sending SMS / WhatsApp messages.
The country code allowlist contains one or more invalid country codes. Please check that each provided country code follows the Alpha-2 standard here: [https://www.iban.com/country-codes](https://www.iban.com/country-codes).
You may only pass in siwe\_params if the wallet type is Ethereum.
Custom claims are too large.
The number of user methods registered to the deny list has exceeded the maximum of 500.
This endpoint has been deprecated
The downstream carrier returned an error. This could be temporary, please try again. If this issue persists, please contact support.
This biometric public key has already been registered. Please register a different key.
Duplicate custom hostname found during CNAME creation. A custom hostname can only be used in one project.
A user with the specified email already exists for this project.
The specified email is already tied to this user.
The client ID submitted is already in use by another client.
An organization with the specified name already exists.
A user with the specified email already exists for this organization.
The phone number provided is already associated with an existing Stytch user.
The specified phone number is already tied to this user.
A project user for the specified organization user already exists for this project.
A redirect URL already exists for the provided URL.
A user with the specified external\_id already exists for this project.
A user with the specified crypto wallet address already exists for this project.
The specified crypto wallet address is already tied to this user.
The supplied credential ID already exists for this project.
Dynamic Client Registration is not enabled for this project. Please enable them in the dashboard to continue: [https://stytch.com/dashboard/connected-apps](https://stytch.com/dashboard/connected-apps).
All resource\_ids must be nonempty.
All role\_ids must be nonempty.
All scopes must be nonempty.
Invalid name. Valid webauthn registration names are non-empty.
The Datadog config is invalid. Ensure there is a valid API Key and Site.
The Grafana Loki config is invalid. Ensure there is a valid URL, username, and password.
The destination type is invalid. Please use one of the following: datadog, grafana\_loki.
The streaming status is invalid. Please use one of the following: active, disabled, pending.
A project can only have one active event log streaming destination.
The TOTP for this user has expired without being verified.
Zero width space (U+200B) identified in request, please remove.
ID token is expired.
ID token's audience does not match the OAuth configuration's ID.
ID token is invalid.
The provided nonce does not match the nonce in the ID token.
The access token is expired.
The authorization code is expired.
Access Token Custom Audience is invalid, should be less than 255 characters.
Access Token Expiry Minutes is invalid, should be between 5 to 1440 minutes.
Access Token Template Content is invalid, should be less than 255 characters.
The refresh token has already been used.
The refresh token is expired.
The email provided has been marked as inactive by our email provider.
Session token and session duration are arguments for Stytch sessions. Leave these arguments blank when using IDP sessions.
The client secret submitted is not secure enough. Please generate a more secure secret.
The append\_salt value is not supported because it's too long.
The iteration\_amount value is invalid.
The key\_length value is invalid.
The memory value is invalid.
The salt value is an unsupported length.
The threads value is invalid.
Invalid argument.
The authentication type provided in the header of the request is invalid. The Stytch API uses basic authentication. See more about authenticating Stytch API requests here.
Invalid authenticator type. The valid values are platform and cross-platform.
The authorization header provided with the request is invalid.
The provided project\_id is a Consumer project and this endpoint is only enabled for B2B projects. Please go to [https://stytch.com/docs/home](https://stytch.com/docs/home) for the consumer version.
The provided hash isn't a base64 encoded string. Please base64 encode the hash before passing it to this endpoint.
The provided salt isn't a base64 encoded string. Please base64 encode the salt before passing it to this endpoint.
The bcrypt cost value is too high, it must be less than 15. If you need a higher cost parameter, please email [support@stytch.com](mailto:support@stytch.com).
The bcrypt hash passed is not valid.
biometric\_registration\_id format is invalid.
The callback URL has an invalid OAuth Callback ID. Please find it in the dashboard at [https://stytch.com/dashboard/](https://stytch.com/dashboard/) and follow the steps there to enter it into the identity provider
captcha\_provider\_id format is invalid.
provider\_type should be set to 'GoogleRecaptchaEnterpriseSilentWeb', 'GoogleRecaptchaEnterpriseSilentAndroid', or 'GoogleRecaptchaEnterpriseSilentIOS',.
threshold should be in the range 0 to 1 inclusive.
Code format is invalid.
Connected Apps must be created with a valid client type. Accepted types are 'first\_party', 'first\_party\_public', 'third\_party', and 'third\_party\_public'.
Invalid CreateUser request. Please provide either an email or phone\_number in the request.
crypto\_wallet\_address must be nonempty.
The `crypto_wallet_id` is invalid (i.e. not properly formatted) or missing. `crypto-wallet-test-dbbd372e-79f8-48ea-907c-5f0755e7d328` is an example `crypto_wallet_id`.
Thanks for trying Stytch! Replace the default URL with your own to get started. If you haven't already done so, you'll also need to set your magic\_link\_urls in the dashboard here: [https://stytch.com/dashboard/redirect-urls](https://stytch.com/dashboard/redirect-urls)
Invalid domain, ensure that only the domain was provided. Do not include `https://` or a port in this value. Visit the link here for more information about valid domains (called RP ID on the site).
The email address is invalid (i.e. not properly formatted) or missing. Check that the email address is properly formatted and only includes allowed characters.
Email domain is too large. Please contact support if this is a valid email.
email html is not valid.
The `email_id` is invalid (i.e. not properly formatted) or missing. `email-test-81bf03a8-86e1-4d95-bd44-bb3495224953` is an example `email_id`.
email plaintext is not valid.
Invalid email. The [sandbox@stytch.com](mailto:sandbox@stytch.com) email can only be used in the Test environment.
email subject is not valid.
The email template contains a disallowed phrase. If you think this is an error, please contact [support@stytch.com](mailto:support@stytch.com).
crypto\_wallet\_address format is invalid for an Ethereum address. Expecting a string starting with 0x followed by 40 hexadecimal characters.
Please ensure exactly one of the following is provided: email\_address, phone\_number.
The provided user does not have exactly one factor that's either an email or a phone.
Expiration is invalid, should be between 5 and 10080 minutes.
expiration\_minutes is invalid, should be between 1 and 10 minutes.
from\_local\_part format is invalid.
hash is invalid.
The `hash_type` is invalid. Please check here for a list of supported hash types.
ID format is invalid.
Impersonation reason must be less than 255 characters.
invite\_magic\_link\_url format is invalid. Common issues include using http instead of https or omitting https\://.
invite\_redirect\_url format is invalid. Common issues include using http instead of https or omitting https\://.
ip\_address format is invalid.
locale is invalid.
login\_magic\_link\_url format is invalid. Common issues include using http instead of https or omitting https\://.
login\_redirect\_url format is invalid. Common issues include using http instead of https or omitting https\://.
login\_redirect\_url format is invalid. Common issues include using http instead of https or omitting https\://.
The client scope was invalid. Client scopes must be at most 128 characters long and must not contain spaces, backslashes, or quotes.
The client status sent was invalid. Client statuses must be either 'active' or 'disabled'.
magic\_link\_url format is invalid. Common issues include using http instead of https or omitting https\://.
The MD5 hash passed is not valid.
The `method_id` is invalid (i.e. not properly formatted) or missing. `email-test-81bf03a8-86e1-4d95-bd44-bb3495224953` is an example `method_id`.
The mobile header sent is invalid.
The OAuth attach token could not be matched.
We didn't recognize the OAuth provider name in the request. Check that the argument is the name of a supported OAuth provider.
oauth\_user\_registration\_id format is invalid.
organization\_id format is invalid.
Organization name cannot be longer than 128 characters.
password\_id format is invalid.
reset\_password\_redirect\_url is invalid. Common issues include using http instead of https or omitting https\://.
The LUDS password complexity should be between 1 and 4, inclusive.
The minimum password length should be between 8 and 32, inclusive.
The provided PBKDF-2 algorithm is invalid. Valid arguments are 'sha256' and 'sha512'.
The PBKDF-2 hash passed is not valid.
The provided PBKDF-2 iteration\_amount value is invalid. Valid range: 512-900000.
The provided PBKDF-2 salt is invalid.
All actions used in RBAC role permissions must be defined within their respective resource.
All resources used in RBAC role permissions must be defined.
The phone number is invalid, i.e. not properly formatted, or missing.
The phone number's country code is invalid, unsupported, or disabled for your Project.
Thanks for trying Stytch! Replace the test phone number with a valid one to start sending one-time passcodes.
Phone number is invalid. The sandbox phone number, +10000000000, can only be used in the Test environment.
The phpass hash has an incorrect format as it needs to be exactly 34 characters.
The phpass hash is invalid as it needs to start with $P$
The PKCE Code Challenge param may only contain alphanumerics and the reserved characters '-', '.', '\_', or '\~'. It must also be between 43 and 128 characters long. Please refer to [https://datatracker.ietf.org/doc/html/rfc7636#section-4.2](https://datatracker.ietf.org/doc/html/rfc7636#section-4.2) for details.
The PKCE Code Verifier param may only contain alphanumerics and the reserved characters '-', '.', '\_', or '\~'. It must also be between 43 and 128 characters long. Please refer to [https://datatracker.ietf.org/doc/html/rfc7636#section-4.1](https://datatracker.ietf.org/doc/html/rfc7636#section-4.1) for details.
The prepend\_salt value is not supported because it's too long.
project\_id format is invalid.
The project ID provided in the basic authentication header is invalid. Please check to make sure the format is correct and there are no trailing whitespaces. To view your project ID please visit the Stytch Dashboard here.
The project name is invalid.
Invalid public key. The key is present but is malformed and cannot be decoded. The field should be base64 encoded.
Invalid public key credential. Please confirm you're passing a correctly formatted public key credential.
Invalid public key credential. The authenticatorData field is present but is malformed and cannot be decoded. The field should be base64 encoded.
Invalid public key credential. The id field is present but is malformed and cannot be decoded. The field should be base64 encoded.
Invalid public key credential. The signature field is present but is malformed and cannot be decoded. The field should be base64 encoded.
Invalid public key credential. The attestationObject field is present but is malformed and cannot be parsed.
Invalid public key credential. The clientDataJSON field is present but is malformed and cannot be parsed.
Invalid public key credential. The public key credential is missing the attestationObject field.
Invalid public key credential. The public key credential is missing the authenticatorData field.
Invalid public key credential. The public key credential is missing the clientDataJSON field.
Invalid public key credential. The public key credential is missing an id field.
Invalid public key credential. The public key credential is missing the response field.
Invalid public key credential. The public key credential is missing the signature field.
The `public_token` used to instantiate the Stytch SDK is invalid. You can find your `public_token` in the Project ID & API keys section of the Project Overview in the Stytch Dashboard.
You may not use the pre-defined role names of 'stytch\_member' or 'stytch\_admin' in your custom roles.
The role assignment provided is not properly formatted. Make sure both a domain and role\_id are included.
The role\_id provided is not valid for this project's RBAC policy.
Scopes cannot contain whitespace, '\\', or '"'
You may not edit the role\_id or description of the stytch\_user, stytch\_member, or stytch\_admin roles.
The recovery\_code submitted was invalid.
Invalid redirect URL Type. Type should be login, invite, signup, reset\_password, or discovery. Only B2B projects can pass discovery.
reply\_to\_local\_part format is invalid.
Invalid request. Ensure that your project ID exists is passed into the URI path.
request\_id format is invalid.
Invalid request value, request is required and must have a value.
Role specified is invalid.
Please make sure that the scopes requested are included in the client.
`scopes` is not a recognized parameter. Please use `scope` instead.
The n parameter is invalid. It needs to be greater than 1, a power of 2, and less than or equal to 262,144. If you need a higher n parameter, please email [support@stytch.com](mailto:support@stytch.com).
The scrypt parameters are too large. The r parameter multiplied by p parameter must be under 2 raised to the 30th power (r \* p \< 2^30).
The salt value is an unsupported length.
The secret provided in the basic authentication header is invalid. Please check to make sure the format is correct and there are no trailing whitespaces. To create a new secret for your project or to confirm an existing secret please visit the Stytch Dashboard here.
secret\_id format is invalid.
session\_duration\_minutes is invalid, should be between 5 to 527040 minutes.
session\_id format is invalid.
session\_management\_type should be set to 'none', 'idp', or 'stytch'.
Cannot create a new session without primary factors.
The session\_token format is invalid (i.e. not properly formatted). Stytch will return this error if the `session_token` or `session_jwt` is invalid, e.g. malformed, too few characters, too many etc.
The session\_token you provided is a sample one from the Docs. Please use a session\_token that you received from a /sessions/authenticate request.
The SHA-1 hash passed is not valid.
The SHA-512 hash passed is not valid.
signature is invalid.
signup\_magic\_link\_url format is invalid. Common issues include using http instead of https or omitting https\://.
signup\_redirect\_url format is invalid. Common issues include using http instead of https or omitting https\://.
signup\_redirect\_url format is invalid. Common issues include using http instead of https or omitting https\://.
chain\_id must be the string representation of an integer between 1 and 9,223,372,036,854,775,771, inclusive.
Domain must be a valid RFC 3986 authority. Do not include the scheme in the domain.
message\_request\_id must be a valid pchar according to RFC 3986 definitions and must not exceed 100 characters.
Resources must be a list of valid RFC 3986 URIs.
Statement may only include reserved, unreserved, or space characters according to RFC 3986 definitions. The statement must not contain other forms of whitespace such as newlines, tabs, and carriage returns. The statement must not exceed 200 characters.
URI must be a valid RFC 3986 URI.
crypto\_wallet\_address format is invalid for an Solana address. Expecting a 32 or 44 character base58 string.
RBAC resources may not be prefixed with `stytch`.
The subject provided is invalid.
template\_id format is invalid.
template\_values must only consist of string keys that map to string values.
Token format is invalid.
Thanks for trying Stytch! Replace the test token with a valid one found in a Stytch email to start authenticating users.
The totp\_code submitted was invalid. The totp\_code must be 6 digits long.
totp\_id format is invalid.
Provided trusted auth token is not valid
URL format is invalid. Common issues include using http instead of https or omitting https\://. If including query parameters use {} as a placeholder value. For example: [https://example.com/authenticate?redirect=\{}](https://example.com/authenticate?redirect=\{})
user\_agent format is invalid.
The `user_id` is invalid (i.e. not properly formatted) or missing. `user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6` is an example `user_id`.
User lock threshold must be inside the range \[1, 100]
User lock TTL value must be inside range \[300, 604800]
The passed crypto\_wallet\_address belongs to a different user than the user\_id provided.
crypto\_wallet\_type is invalid.
The domain cannot be longer than 255 characters.
webauthn\_registration\_id format is invalid.
RBAC actions may not contain the wild character, `*`.
JWT Template did not produce valid JSON output.
JWT Template contains an invalid tag.
JWT Template contains a mismatched set of tags.
Invalid argument sent to Test environment. Looks like you supplied a Live identifier for a request for the Test environment (test.stytch.com). Try sending a request to api.stytch.com instead or using a different identifier.
The client is already in a secret rotation flow. Please finish or cancel the current secret rotation flow before starting a new one.
M2M Client Description may not be larger than 512 characters.
M2M Client ID may not be larger than 128 characters.
M2M Client Name may not be larger than 128 characters.
M2M Client Secret may not be larger than 128 characters.
M2M Client status must be either 'active' or 'inactive'.
The m2m client requested could not be found.
The client is not in a secret rotation flow. Please start a secret rotation flow before calling this endpoint.
Expected m2m search filter\_value to contain an array of strings.
Expected m2m search operand 'filter\_name' to be a string.
The m2m search operand filter name was not recognized.
Expected m2m search operand to contain a 'filter\_name' key.
Expected m2m search operand to contain a filter\_value key.
Please ensure that the user and email exist before migrating an external session.
The project is missing the OIDC userinfo endpoint. Please configure one in the Stytch dashboard and try again.
An error was encountered when querying the external provider's userinfo endpoint.
The Apple OAuth config is missing an App ID value.
One or more of the parameters in the custom SMS request could not be found.
This trusted token profile using public key type JWK must have a JWKS url
This trusted token profile using public key type PEM must have at least one PEM file
No active mobile biometric registrations were found.
No active WebAuthn registrations for this user ID and domain. To create one, first hit the WebAuthn register/start endpoint. Complete the registration by subsequently hitting the WebAuthn register endpoint.
A session was passed in on the /send request but not on this request
There is no default discovery redirect URLs set for this project, so we are unable to redirect the user to the application. Please include a discovery redirect URL in the request or set a default for this project. To set discovery redirect URLs for this project please visit [https://stytch.com/dashboard/redirect-urls](https://stytch.com/dashboard/redirect-urls)
There is no default invite redirect URLs set for this project, so we are unable to redirect the user to the application. Please include a invite redirect URL in the request or set a default for this project. To set invite redirect URLs for this project please visit [https://stytch.com/dashboard/redirect-urls](https://stytch.com/dashboard/redirect-urls)
There is no default login redirect URLs set for this project, so we are unable to redirect the user to the application. Please include a login redirect URL in the request or set a default for this project. To set login redirect URLs for this project please visit [https://stytch.com/dashboard/redirect-urls](https://stytch.com/dashboard/redirect-urls)
There is no default signup redirect URLs set for this project, so we are unable to redirect the user to the application. Please include a signup redirect URL in the request or set a default for this project. To set signup redirect URLs for this project please visit [https://stytch.com/dashboard/redirect-urls](https://stytch.com/dashboard/redirect-urls)
Unable to verify the provided `invite_magic_link_url`. There are no invite redirect URLs set for this project so we are unable to verify the `invite_magic_link_url` provided in the request. To set invite redirect URLs for the project please visit the Dashboard here. For more information on why this validation is necessary please read more here.
Unable to verify the provided `login_magic_link_url`. There are no login redirect URLs set for this project so we are unable to verify the `login_magic_link_url` provided in the request. To set login redirect URLs for the project please visit the Dashboard here. For more information on why this validation is necessary please read more here.
The `magic_link_url` in the request did not match any redirect URLs set for the project. Please visit the Stytch Dashboard here to update the redirect URLs for the project. For more information on why this validation is necessary please read more here.
The oauth redirect url in the request did not match any redirect URLs set for this project. Please visit [https://stytch.com/dashboard/redirect-urls](https://stytch.com/dashboard/redirect-urls) to update the redirect URLs for this project. For more information on why this validation is necessary please visit [https://stytch.com/docs/api/url-validation](https://stytch.com/docs/api/url-validation)
The sso redirect url in the request did not match any redirect URLs set for this project. Please visit [https://stytch.com/dashboard/redirect-urls](https://stytch.com/dashboard/redirect-urls) to update the redirect URLs for this project. For more information on why this validation is necessary please visit [https://stytch.com/docs/api/url-validation](https://stytch.com/docs/api/url-validation)
Please ensure only one of the following is passed: session\_token, session\_jwt, or user\_id. Exactly one of those values is required to identify the user.
Unable to find a pending registration tied to this user. Please ensure you've first hit the WebAuthn register/start endpoint with the supplied `user_id`.
Please ensure you're passing exactly one session field.
Please include a session\_id, session\_token, session\_jwt, or a member\_id (if the project is a B2B project). Exactly one of those values is required to revoke a session.
Unable to verify the provided `signup_magic_link_url`. There are no sign-up redirect URLs set for this project so we are unable to verify the `signup_magic_link_url` provided in the request. To set signup redirect URLs for the project please visit the Dashboard here. For more information on why this validation is necessary please read more here.
An existing user doesn't have an password. A password can be added to a user through the password reset endpoint.
Please include exactly one of user\_id, session\_token, or session\_jwt. This request did not contain any of those fields.
The token used for Access Token exchange was missing the Full Access scope. The Full Access scope is required to call this endpoint.
The token used for Access Token exchange must be generated from an 'authorization\_code' grant.
The token used for Access Token exchange is more than five minutes old. A fresh Access Token is required to call this endpoint.
You did not authorize this app to perform a signup or login. To use this app, log in again and authorize the required permissions during the login flow. Please reach out to the application developer for more support.
An error occurred during the OAuth callback.
The OAuth callback request is invalid. Please reach out to the application developer for support.
An invalid scope has been requested. Please check the set of scopes and try again.
The OAuth state is invalid. Please reach out to the application developer for support.
The state in the cookie doesn't match with the state in the query parameter. Please retry your login flow. If you continue receiving this error, reach out to the application developer for support.
The OAuth state value has already been used.
Provider did not respond with required information during OAuth token exchange, please try again. If the problem persists, please reach out to support.
Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). Please check the client ID and secret of your OAuth configuration.
The request is missing a required parameter, includes an unsupported parameter value (other than grant type), repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed. Please reach out to support.
The scopes requested were invalid. Please check the scopes you are requesting and try again.
Expired client secret provided. Ensure the secret in your OAuth configuration is up to date. You may need to add a new secret in your Microsoft Azure portal.
Invalid client secret provided. Ensure the secret in your OAuth configuration is the client secret value, not the client secret ID.
The authenticated client is not authorized to use this authorization grant type. Please check your settings and try again. If the problem persists, please reach out to support.
If 'none' is used as a value for the 'prompt' parameter, then it must be the only value.
The information provided in the ID token and userinfo did not include a email.
User already has a password associated with it. Please use the password reset endpoint to update the password if needed.
Password validation timed out. Possible causes include an excessively long password or a high volume of requests.
The passwords product is incompatible with opaque errors in the project SDK configuration. Please change the configuration in the dashboard to continue: [https://stytch.com/dashboard/sdk-configuration](https://stytch.com/dashboard/sdk-configuration).
The provided PBKDF-2 key\_length does not match the length of the decoded hash.
Cannot create a new TOTP for the specified user since the user has a pending TOTP that has not yet expired. Please try creating a new TOTP for the user once the pending one has expired or delete the pending TOTP before attempting to create a new one.
This flow was started without a code\_challenge but the authentication call includes a code\_verifier.
This flow was started using a code\_challenge but the authentication call is missing the corresponding code\_verifier.
The submitted code\_verifier does not match the code\_challenge sent at the start of the flow.
Stytch requires native or mobile applications, as well as public clients, to use PKCE for all flows involving redirects. Please supply a code\_challenge with the request.
One of the callback URLs supplied is for a native or mobile application. Stytch requires native or mobile applications to use PKCE for all flows involving redirects. Please supply a code\_challenge with the request.
Private key is too long. Please make sure you have the correct value.
Project has no public\_tokens. Please create one in the Dashboard at [https://stytch.com/dashboard/api-keys](https://stytch.com/dashboard/api-keys).
Public Connected Apps do not have secrets.
Public key missing from request
public\_token is required.
The `magic_link_url` in the request provided query parameters that did not match any redirect URLs set on the Stytch Dashboard for the project. Please visit the Stytch Dashboard here to make any necessary updates. For more information on why this validation is necessary please read more here.
There is a duplicate action in your RBAC policy. Please remove it. Actions are case insensitive.
The action name provided was too long. Actions must be less than 100 characters.
The description provided was too long. Descriptions must be less than 500 characters.
Common domains such as gmail.com are not allowed in rbac\_email\_implicit\_role\_assignments.
Please ensure that all domains in rbac\_email\_implicit\_role\_assignments are valid domains.
All permissions must have at least one action.
There is a reserved scope in your RBAC policy. Please remove it. Reserved scopes include 'openid', 'profile', 'email', 'phone', 'offline\_access', 'full\_access'.
There is a duplicate resource ID in your RBAC policy. Please remove it. Resource IDs are case insensitive.
The resource\_id provided was too long. Resource IDs must be less than 100 characters.
All resources must have at least one action.
There is a duplicate role ID in your RBAC policy. Please remove it. Role IDs are case insensitive.
The role\_id provided was too long. Role IDs must be less than 100 characters.
All roles must have at least one permission.
There is a duplicate scope in your RBAC policy. Please remove it. Scopes are case insensitive.
All scopes must have at least one permission.
The scope provided was too long. Scopes must be less than 100 characters.
The totp\_code submitted was invalid. Based on the format of the submitted value it looks like a recovery\_code was entered instead. To authenticate a recovery code please use the /v1/totps/recover endpoint. You can read more here: [https://stytch.com/docs/api/totp-recover](https://stytch.com/docs/api/totp-recover).
Redirect URLs are not allowed to use this protocol. Please use a different protocol for your native application. If you believe this to be in error, please contact [support@stytch.com](mailto:support@stytch.com) for assistance.
Redirect URLs for web applications must use HTTPS unless redirecting to localhost. Please change the protocol to HTTPS.
Redirect URLs with query param placeholders ({}) cannot be set as a default redirect URL.
a custom email domain is required for custom html emails.
Cannot use a reserved claim as one of your custom claims.
User must reset their password through the password reset endpoint. This occurs if a user's credentials appeared in the HaveIBeenPwned dataset or the user used email based authentication (e.g. Magic Links, Google OAuth) without previously verified their email address. The password reset ensures that the user is the legitimate owner of the mail address. This stops malicious actors from abusing the compromised credentials or attempting to pre-hijack account by setting a password for an email.
You must provide one of email\_id or email\_address in the request.
Bearer token rotation has not been started for this connection. Please start a token rotation flow before calling this endpoint.
The key\_length value doesn't match the length of the provided hash.
status should be set to 'active', 'pending', 'invited', or 'deleted'.
Search timed out. Please try using a more specific search query
This action requires either a session\_token or session\_jwt of the user this authentication factor was attached to.
The provided session has no active factors and has been revoked.
Attempting to extend or add a factor to an immutable session. The session is considered immutable due to it containing an immutable auth factor.
The session passed in on the /send request does not match the one passed in on this request
The signature is the incorrect size in bytes.
Signature missing from request
The SIWE message is expired.
The SIWE message is not valid yet.
Cannot use [https://stytch.com/session](https://stytch.com/session) as a custom claim.
Invalid argument sent to Live environment. Looks like you supplied a Test identifier inside a request for the Live environment (api.stytch.com). Try sending the request to test.stytch.com instead or using a different identifier.
The Full Access scope can only be granted to First Party clients.
Offline Access consent can only be bypassed by First Party clients.
The provided user\_id has reached the maximum allowed mobile biometric registrations. The maximum is 25.
Too many clients have been created for this project
You have reached the maximum number of email templates for this project. Please delete an email template before creating a new one.
Too many scopes were attached to the client. A maximum of 1000 scopes is allowed.
This trusted token profile has too many PEM files. Please remove one to add more.
You have reached the maximum number of projects for your workspace. Please delete a project before creating a new one.
You have reached the maximum number of public tokens for this project. Please delete a public token before creating a new one.
You have reached the maximum number of redirect URLs for this project. Please delete a redirect URL before creating a new one.
RBAC policies contain too many roles.
You have reached the maximum number of secrets for this project. Please delete a secret before creating a new one.
Please include at most one of session\_token, session\_jwt, or intermediate\_session\_token in an authenticate request, not multiple.
Please ensure only one of the following is passed: session\_id, session\_token, session\_jwt, or a member\_id (if the project is a B2B project). Exactly one of those values is required to revoke a session.
The current project has already hit the maximum of 5 SMS templates. Please delete one in order to create another.
This project has too many trusted token profiles. Please remove one to add more.
We were unable to create a new auth factor. This user already has too many unverified factors.
The provided user\_id has reached the maximum allowed WebAuthn registrations for the provided domain. The maximum is 25.
Please include exactly one of user\_id, session\_token, or session\_jwt. This request contained more than one of those fields.
This TOTP code has already been authenticated. Please attempt with the next generated code.
The recovery\_code submitted was invalid. Based on the format of the submitted value it looks like a totp\_code was entered instead. To authenticate a totp code please use the /v1/totps/authenticate endpoint. You can read more here: [https://stytch.com/docs/api/totp-authenticate](https://stytch.com/docs/api/totp-authenticate).
Trusted token profile attribute mapping cannot multiple external ID attribute mappings.
Trusted token profile has the wrong external ID attribute mapping for this project vertical.
Trusted token profile is missing a required field.
The crypto wallet could not be authenticated.
Unable to authorize request to this OAuth provider. Please check the client ID and secret of your OAuth configuration.
The messaging server returned a non-positive response while trying to delete this suppression.
Cannot delete the last public\_token for a project. Please create another public\_token before deleting this one.
Unable to parse session JWT
The Biometric registration could not be registered.
The WebAuthn registration could not be registered.
Unable to represent custom claims as a JSON map.
Please check that the `client_id` and `client_secret` are correct, and that the client exists and is active.
User has unsubscribed. User must resubscribe by texting 'START' before messages can be sent.
Unsupported grant type. Note that the `grant_type` parameter must be equal to `client_credentials` in order for the request to succeed.
Update user no longer accepts phone\_numbers, emails, or crypto\_wallets. To add these authentication factors to an existing user, use their respective Send endpoints.
The user has already been invited.
User cannot be impersonated
Cannot mix internal and external user ids for this filter
Expected email\_address\_fuzzy to have a length of at least 3 but it was too short. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search filter\_value to contain an array of strings. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search filter\_value to contain a boolean. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search filter\_value to contain an object. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search filter\_value to contain a string. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search filter\_value to contain a string containing a RFC3339 formatted timestamp. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search operand filter\_name to be a string. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
The user search operand filter\_name was not recognized. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected full\_name\_fuzzy to have a length of at least 3 but it was too short. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
The submitted cursor is not valid. Please contact [support@stytch.com](mailto:support@stytch.com) for assistance.
limit should be in the range 1 to 1000 inclusive.
provider should be set to 'Amazon', 'Apple', 'Bitbucket', 'Coinbase', 'Discord', 'Facebook', 'Figma', 'Github', 'GitLab', 'Google', 'Instagram', 'LinkedIn', 'Microsoft', 'Salesforce', 'Shopify', 'Slack', 'Snapchat', 'Spotify', 'Steam', 'TikTok', 'Twitch', 'Twitter', or 'Yahoo'.
operator should be set to 'AND' or 'OR'.
status should be set to 'active' or 'pending'.
The number of filter values passed in the search request exceeded our maximum of 1000. Please try again with a lower number.
Expected biometric\_registration\_ids to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected field `biometric_registration_ids` to be passed in the search request but it was not. Please see search users endpoint for request schema details and examples.
Expected created\_at\_greater\_than to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected created\_at\_less\_than to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected crypto\_wallet\_address to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected crypto\_wallet\_id to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected crypto\_wallet\_verified to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected email\_address\_fuzzy to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected email\_addresses to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected email\_domain to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected email\_ids to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected email\_verified to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search operand to contain a filter\_name key. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search operand to contain a filter\_value key. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected full\_name\_fuzzy to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search filter\_value to contain greater\_than key. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user search filter\_value to contain less\_than key. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected oauth\_providers to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected field `password_exist` to be passed in the search request but it was not. Please see search users endpoint for request schema details and examples.
Expected phone\_ids to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected phone\_number\_fuzzy to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected phone\_numbers to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected phone\_verified to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected status to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected totp\_ids to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected totp\_verified to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected user\_ids to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected webauthn\_registration\_ids to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected webauthn\_verified to be passed in the search request but it was not. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Expected phone\_number\_fuzzy to have a length of at least 3 but it was too short. Please see [https://stytch.com/docs/api/search-users](https://stytch.com/docs/api/search-users) for request schema details and examples.
Password doesn't meet the API's strength requirements. A password's strength could be tested with the password strength check endpoint.
Wrong endpoint, try hitting test.stytch.com instead.
Wrong endpoint, try hitting api.stytch.com instead.