Sign-in errors
Problems with email and password sign-in, confirmation links, Google and GitHub sign-in, sessions and admin access.
Email and password
I didn't get the confirmation email
On your computer, without Resend: nothing is sent. The email is printed in the terminal running npm run dev, and the sign-up page says so. Look for:
[email] to=you@example.com subject="Confirm your email for …"
…
Confirm email: http://localhost:3000/api/auth/verify-email?token=…Copy the link into your browser.
With Resend: check spam first. Then see Email errors: the domain may not be verified yet.
"Please confirm your email first. We sent you a new link."
Why: the account exists but its email isn't confirmed. A new confirmation link was just sent (or printed in your terminal).
Fix: click the newest link. Older links may have expired.
"Invalid email or password"
Why: the email or password is wrong, or the account was created with Google or GitHub and has no password.
Fix: check for typos, or use Forgot password. If you signed up with Google or GitHub, use that button. Using Forgot password on such an account adds a password to it.
"Password too short"
Passwords need at least 8 characters.
I signed up again and nothing happened
Why: the email already has an account. To stop anyone checking which emails have accounts, the screen looks the same as a new sign-up. The owner gets an email: "You already have a … account", with a sign-in link.
Fix: sign in, or use Forgot password.
The confirmation or reset link says it expired
The page shows "Link expired. This reset link is invalid or has expired.", or you land back on the sign-in page.
Why: the link is old, was already used, or a newer link replaced it.
Fix: for confirmation, sign in again: a new link is sent automatically. For a password reset, click Request a new link.
The link in the email opens localhost
Why: NEXT_PUBLIC_APP_URL in production is still http://localhost:3000.
Fix: in Vercel, set NEXT_PUBLIC_APP_URL to your real address and redeploy.
The email and password form is missing in production
Why: without RESEND_API_KEY, the live site can't send confirmation emails, so it only offers Google and GitHub.
Fix: set up Resend, make sure RESEND_API_KEY is set in Vercel, and redeploy.
No sign-in buttons at all
Why: in production with no Resend key and no Google or GitHub keys, there's no way left to sign in.
Fix: set up at least one of Resend, Google or GitHub, and redeploy.
"Too many requests. Please try again later."
Why: rate limiting. Too many sign-in attempts in a short time.
Fix: wait a minute and try again. When testing, avoid scripts that sign in in a loop.
"You have been banned from this application. Please contact support if you believe this is an error."
Why: an admin banned this account in /admin.
Fix: an admin can unban it from the user list in /admin.
Error 400: redirect_uri_mismatch
Why: the callback URL your app sent isn't in the OAuth client's Authorized redirect URIs. Google compares them exactly.
Fix: Google's error page shows the URL it received (click error details). Add exactly that URL under APIs & Services → Credentials → your OAuth client → Authorized redirect URIs, for example:
http://localhost:3000/api/auth/callback/googlehttps://yourdomain.com/api/auth/callback/google
Watch for http vs https, www vs no www, and trailing slashes. Changes can take a few minutes to apply.
If the URL Google shows has the wrong domain (for example localhost on your live site), fix NEXT_PUBLIC_APP_URL in Vercel and redeploy.
Error 403: access_denied (app is being tested)
Why: the OAuth consent screen is still in Testing, and only listed test users can sign in.
Fix: publish the app: OAuth consent screen (or Audience) → Publish app. Or add the user's Gmail under Test users while testing.
Error 403: org_internal
Why: the consent screen's user type is Internal, which only allows accounts in your Google Workspace.
Fix: change the user type to External.
Error 401: invalid_client
Why: GOOGLE_CLIENT_ID or GOOGLE_CLIENT_SECRET is wrong, has extra spaces, or the client was deleted.
Fix: copy both again from Credentials (create a new secret if needed), update .env.local or Vercel, and restart or redeploy.
"Continue with Google" button doesn't appear
Why: the button only appears when both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are set.
Fix: set both. Locally, restart npm run dev. On Vercel, add them and redeploy.
GitHub
"The redirect_uri is not associated with this application."
Why: the app's Authorization callback URL doesn't match where you're signing in. A GitHub OAuth app allows only one callback URL.
Fix: set it to https://yourdomain.com/api/auth/callback/github (or the localhost version), or create a second app for the other environment. See Google and GitHub sign-in.
"That account didn't share an email address with us. Try another sign-in option."
The URL ends with error=email_not_found.
Why: GitHub didn't return a verified email for the account.
Fix: the user should verify an email in GitHub (Settings → Emails), then try again. Or sign in another way.
incorrect_client_credentials / sign-in fails right after approving
Why: GITHUB_CLIENT_SECRET is wrong, or was regenerated in GitHub.
Fix: generate a new client secret in the OAuth app's settings, update it, restart or redeploy.
Both providers
account_not_linked
An account with this email already exists, and that provider hasn't verified the email address. Verify it with the provider, or sign in with your email and password.Why: an account already uses this email, and the provider didn't confirm the person owns it. Linking it anyway would let someone take over that account.
Fix: verify the email with the provider, or sign in the original way.
"Sign-in didn't complete. Please try again."
Why: the provider returned an error the kit doesn't have a specific message for, often state_mismatch: the sign-in started in one browser tab or domain and finished in another, or cookies are blocked.
Fix: try again in one tab, starting from your site's own address (not a vercel.app address if you use a custom domain). Allow cookies for your site. If it keeps happening on the live site, check NEXT_PUBLIC_APP_URL matches the address in your browser exactly.
Sessions
Asked to sign in again on every visit
- Address mismatch: cookies are set for the address in
NEXT_PUBLIC_APP_URL. Visiting a different one (wwwvs nowww, avercel.appaddress) has no session. Redirect all addresses to one, and set it asNEXT_PUBLIC_APP_URL. - Secret changed: changing
BETTER_AUTH_SECRETsigns everyone out once. Expected. - Old kit version: an earlier version sent signed-in users to sign-up from the landing page buttons. Pull the latest kit.
Everyone was signed out
Why: BETTER_AUTH_SECRET changed (for example, running setup on another computer generated a new one and it was deployed).
Fix: nothing to undo: users sign in again. Keep one secret per project, stored safely.
Admin
/admin shows 404 Not Found
Why: your account isn't an admin. Non-admins get a 404 on purpose.
Fix: npm run make-admin -- you@example.com, using the database your site uses, then reload /admin. See Admin dashboard.