Error

Machine-readable error code. Possible values:

• INVALID_CLIENT: Unknown/disabled client or bad format.
• VALIDATION_ERROR: Generic input validation failure.
• INVALID_CREDENTIALS: Invalid email/password or bearer/refresh token.
• ACCOUNT_LOCKED: Temporarily locked due to too many failed attempts.
• ACCOUNT_DISABLED: Account deactivated/blocked.
• EMAIL_ALREADY_IN_USE: Signup email conflicts with existing account.
• PASSWORD_POLICY_FAILED: Password does not meet policy requirements.
• WEAK_PASSWORD_BREACHED: Password appears in known breach lists.
• INVALID_REFRESH_TOKEN: Refresh token is malformed/unknown/reused incorrectly.
• REFRESH_TOKEN_EXPIRED: Refresh token expired per server policy.
• REFRESH_TOKEN_REVOKED: Refresh token revoked due to logout/password change.
• RESET_TOKEN_INVALID: Reset token malformed or not found.
• RESET_TOKEN_EXPIRED: Reset token expired.
• PASSWORD_REUSE_NOT_ALLOWED: New password matches recent password.
• RATE_LIMITED: Too many requests (see Retry-After).
• SERVER_ERROR: Internal error.
• UPSTREAM_TIMEOUT: Transient upstream failure (e.g., email provider, DB).

ID used for tracing and support diagnostics.

Localizable, user-safe message.

Optional structured details about the error.