Common errors and codes

Depending on the complexity of your authentication setup, you or your users may occasionally encounter errors.

Here are some common error codes and troubleshooting steps.

Sorry we don’t see way to authenticate you

Link to this section

This error message typically appears when there’s an issue with your authentication configuration or token handling. A few common causes include:

• Expired or invalid tokens
• Misconfigured authentication settings
• Session management issues
• Incorrect callback URLs

State not found

Link to this section

The State not found error typically occurs when there’s a mismatch between your environment variables and the domain you’re using during authentication. There may be a trailing space or incorrect syntax.

JWKS endpoint returning 403

Link to this section

A 403 Forbidden response from the JWKS endpoint (/.well-known/jwks) means the request was rejected before the public keys could be returned. Common causes include:

• Wrong domain or subdomain - Ensure you are fetching the JWKS endpoint from your correct Kinde domain (e.g. https://your-business.kinde.com/.well-known/jwks). A typo or incorrect region subdomain will result in a 403.
• Unexpected credentials in the request - The JWKS endpoint is public and does not require authentication. Sending unexpected or invalid credentials (e.g. an expired client secret or an Authorization header) can cause the request to be rejected. Remove any authorization headers from JWKS fetch requests.
• CORS misconfiguration - Browser-based applications that fetch JWKS directly may hit CORS restrictions. Perform the JWKS fetch server-side where possible, or verify that your origin is permitted in your Kinde application settings.
• IP allowlist or firewall rules - If your environment or network applies IP restrictions, check that outbound requests to your Kinde domain are not being blocked before they reach the endpoint.

Verification code not received (email)

Link to this section

Verification codes are sent almost immediately when triggered. If a code is not received, it might be because:

• Junk/spam folders​ - Email providers and devices may treat OTPs from unknown providers like Kinde as spam. Check your own spam folder, or ask your IT team if emails from Kinde are quarantined by firewalls or other IT defence systems.
• Gmail delays​ - Google Workspace addresses can experience ~4-minute-delays due to pre-delivery scanning
• Microsoft Defender filters​ - Aggressive anti-spam filters sometimes quarantine verification emails for Outlook/Hotmail users

If none of the above help troubleshoot the issue, contact Kinde support.

Verification code not received (mobile device)

Link to this section

Verification codes are sent almost immediately when triggered. If a code is not received, it might be because:

• Network connectivity problems or poor signal strength
• Carrier-level spam filtering blocking OTP messages
• SMS delivery delays during peak usage times
• Full storage preventing new messages from being received
• Phone numbers in certain countries do sometimes experience issues. Contact us if you think this might be the case.

We recommend configuring your own SMS provider — Twilio or Sinch Engage — instead of using Kinde’s default service. This makes troubleshooting issues and accessing logs much easier.

Email verification error code 123f11e6453744da8069f1a6d65247ba

Link to this section

Description

• This code can appear in the verification link inside a Kinde email verification email

Troubleshooting

• Verification links are time-limited. If the link has expired, request a new verification email and use it promptly
• Make sure the link is opened in the same browser and session in which the verification was requested
• If the error persists after requesting a fresh link, contact Kinde support with the full error code and the email address being verified

Error code 578

Link to this section

Description

• Error coming back to Kinde while validating SAML response

Troubleshooting

• Check that the Assertion Consumer Service (ACS) URL is correct on the identity provider

Error code 780

Link to this section

Description

• The OAuth 2.0 response failed
• The token is valid, but the redirect is null

Error code 928

Link to this section

Description

• Error getting or reading the connected app configuration

Error code 1004

Link to this section

Description

• Error getting custom SAML config while initializing SAML redirect

Error code 1656

Link to this section

Description

• Error with authorization response
• The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed

Troubleshooting

• Missing nonce on implicit flow
• Redirect URI might not be with an https
• Only a localhost suffix can be used with http
• Error with workflow

Error code 1706

Link to this section

Description

• Post-authentication workflow failed to complete and the policy is set to stop

  Example:

  postUserAuthWorkflow.ts

  export const workflowSettings = {
    bindings: {"kinde.env": {}, "kinde.fetch": {}, url: {}},
    failurePolicy: {action: "stop"},
    id: "hubspotSync",
    name: "HubSpot sync",
    trigger: "user:post_authentication"
  };

Troubleshooting

• Review the post-authentication workflow configuration for missing data references, inactive integrations, or misconfigured conditions
• Disable non-essential workflow steps one at a time and retry login to isolate the failing step
• If you need to unblock users while investigating, change the policy setting from stop to warn or allow
• If the workflow was recently modified, restore the previous version using the version history in the workflow settings

Error code 1794

Link to this section

Description

• The state value returned on the social sign-in (OAuth 2.0) callback could not be decrypted or validated
• This usually means the state was tampered with, truncated, expired, or came from a different environment or domain

Troubleshooting

• Start the sign-in flow again from the sign-in or log-in button, rather than from a bookmarked or partially completed auth URL
• Make sure the domain or region you are using matches your Kinde environment exactly — see the State not found section for related mismatch causes
• Retry in a fresh browser session

Error code 1829

Link to this section

Description

• Error exchanging token on connected app callback

Troubleshooting

• Check the redirect URLs for a mismatch
• Check the client credentials

Error code 1959

Link to this section

Description

• Error decoding SAML response
• Response contains invalid characters for Base64 response

Error code 2201

Link to this section

Description

• Post-authentication workflow ran successfully but triggered a deny access action

Troubleshooting

• The workflow is intentionally blocking the user based on a matched condition — this is not a workflow error
• Review the post-authentication workflow conditions to identify which rule is triggering the denial and update it if needed

Error code 3005

Link to this section

Description

• Cannot handle SAML callback
• The userProfile contains invalid values

Error code 3420

Link to this section

Description

• OAuth 2.0 response failed because token is invalid and redirect ID is null

Error code 4030

Link to this section

Description

• Social sign-in (OAuth 2.0 callback) was stopped at the identity provider before a token could be issued
• The provider returned access_denied — typically the user cancelled the sign-in, or an organization/provider policy (such as Microsoft Entra Conditional Access) blocked it

Troubleshooting

• This is often expected (the user closed or declined the provider’s consent screen). Ask the user to try signing in again.
• If it affects all users on a connection, review the social connection’s app and consent configuration at the provider, and any organization policies that may be blocking access.

Error code 4031

Link to this section

Description

• Social sign-in could not complete because the identity provider requires further interaction
• The provider returned interaction_required, login_required, consent_required, or account_selection_required

Troubleshooting

• Ask the user to start the sign-in again and complete any prompts (login, consent, or account selection) shown by the provider.
• This commonly occurs on silent or SSO attempts where the provider needs an interactive session.

Error code 4032

Link to this section

Description

• The identity provider was temporarily unavailable during the social sign-in callback
• The provider returned temporarily_unavailable or server_error

Troubleshooting

• Wait a moment and try signing in again.
• If it continues, check the identity provider’s status page for an outage.

Error code 4033

Link to this section

Description

• The identity provider returned an unrecognized error during the social sign-in (OAuth 2.0) callback

Troubleshooting

• Retry the sign-in.
• If it persists, review the social connection configuration and contact Kinde support with the error code and the provider’s error/error_description from your logs.

Error code 4034

Link to this section

Description

• The social sign-in (OAuth 2.0) callback arrived with neither an authorization code nor an error
• The cross-site form post lost its body in transit on some clients, so there was nothing to exchange

Troubleshooting

• Ask the user to start the sign-in again.
• This is more likely on browsers or privacy settings that strip cross-site POST bodies — ensure cross-site requests and cookies required for the auth flow are not being blocked.

Error code 4179

Link to this section

Description

• Handle Social OAuth 2.0 callback - error exchanging token
• Expired secrets for social provider

Troubleshooting

• Check the secret being used with your social provider and ensure that it hasn’t expired

Error code 4321

Link to this section

Description

• This error typically occurs when a user attempts to access an authentication flow from a mid-step URL instead of starting from the beginning.
• Reasons this error may occur:
  • A bookmarked or previously used URL is reused
  • A step-specific URL is shared directly
  • The user navigates back or forward in the browser and skips required steps in the flow

Troubleshooting

• Ask the user to restart the login flow from the main entry point, such as your app’s login page
• Clear browser cookies and cache before retrying
• Avoid using any bookmarked or shared login URLs

Error code 4617

Link to this section

Description

• Error reading config on OAuth 2.0 callback

Troubleshooting

• Check that the client credentials in both Kinde and IDP are correct
• Check that the redirect and callback URLs in both Kinde and IDP are correct

Error code 5716

Link to this section

Description

• OAuth 2.0 response failed due to an invalid token
• Redirection was successful

Error code 6722

Link to this section

Description

• Error configuring SAML provider This error can appear if IdP-initiated SSO is attempted but not properly configured. Kinde supports both SP-initiated (default) and IdP-initiated SSO flows. If you need IdP-initiated SSO, ensure it’s properly configured. See IdP-initiated SAML SSO for setup instructions.

Troubleshooting

• Check that the settings in the Kinde enterprise connection are correct
• Check enterprise connection metadata URL, entity ID, certificate
• If using IdP-initiated SSO, verify the IdP is configured to send assertions to the correct ACS URL

Error code 7558

Link to this section

Description

• SAML callback tokenInfo returned invalid data

Error code 8030

Link to this section

Description

• Error configuring SAML provider on redirect

Troubleshooting

• Check the enterprise connection metadata URL
• Check that the IDP has the correct ACS URL

Error code 8809

Link to this section

Description:

• Received browser trust token is different from the one stored in the login session

Troubleshooting

• Start the auth flow again from the sign in or log in button
• The user is trying to start a session in a new tab, browser, or device when there’s already a partially completed session in progress
• The user may have bookmarked the auth page when it’s partially completed, instead of bookmarking the initial sign in or log in page

Error code 8998

Link to this section

Description

• During the social sign-in (OAuth 2.0) callback, Kinde could not complete the organization or environment transfer redirect

Troubleshooting

• Retry the sign-in
• If it persists, contact Kinde support with the error code and the psid value from the URL

Error code 9055

Link to this section

Description

• Error getting custom SAML provider configuration
• RelayState is invalid or doesn’t exist

Troubleshooting

• Check the SAML callback URL
• Check the entity ID
• Check that the SAML IDP is returning a valid RelayState

Error code 9364

Link to this section

Description

• Error getting authentication request while initializing SAML redirect

Troubleshooting

• Check the enterprise connection private key, certificate, and signature method

Error code 9697

Link to this section

Error message

• “We can’t finish signing you up as the email domain we detected is not allowed. Try a different sign up method.”

Description

• Sign-up was rejected because the email domain is on Kinde’s list of disposable email providers

This appears when Block disposable email addresses is switched on under Settings > Environment > Policies. The person signing up sees the error message, which is localised, and they are not told the domain was classified as disposable.

See Block disposable email addresses.

Troubleshooting

• Sign up with an email address that is not from a disposable provider
• Invitations, users you add yourself, and existing users are not checked by this policy
• To allow only specific domains, or to block a list of your own, use Allowed domains or a pre-registration workflow

Billing signup — collect payment details errors

Link to this section

These error codes appear on Kinde’s hosted authentication error page when sign-up or plan selection fails during the collect payment details step (payment method and billing details collection, typically as part of a paid plan or trial conversion flow). The page shows a short message and a line such as Error code: 9868.

If you or your customer sees one of these codes:

1. Ask the user to start sign-up again from your app’s login or register entry point (not a bookmarked or mid-flow URL).
2. In the Kinde dashboard, confirm billing is connected to Stripe and the plan the user selected is active and correctly configured.
3. If the code relates to payment method or Stripe setup, check the customer in Stripe for failed setup intents, card errors, or account restrictions.
4. If the problem continues, contact Kinde support with the full error code, the user’s email (if available), and the psid value from the URL when present (same as other auth errors).

Related: Plan selection, Connect to Stripe, Customize page design (route (collect_payment_details)).

Error code 9862

Link to this section

Description

• Collect payment details pipeline step — default / fallback error when the failure does not match a more specific code below

Troubleshooting

• Retry sign-up from the main entry point
• Contact Kinde support with error code 9862 and any psid from the URL if the failure repeats without a more specific code

Error code 9864

Link to this section

Description

• Collect payment details step — billing context is missing (for example, billing customer ID or target plan ID is not in the pipeline session)
• User-facing message: We couldn’t complete your plan selection. Please start a new session and try again.

Troubleshooting

• Do not reuse bookmarked or shared URLs from the middle of sign-up
• Clear cookies for your Kinde domain and restart from your application’s sign-up or register link
• Confirm the user completed plan selection before the payment step when your flow requires it

Error code 9865

Link to this section

Description

• Collect payment details step — Kinde could not save billing details with the payment provider (Stripe)
• User-facing message: We couldn’t save your billing details. Please try again, or contact support if the problem continues.

Troubleshooting

• Verify the Stripe connection for the environment (Settings > Environment > Billing)
• Retry after a few minutes in case of transient Stripe API errors
• Contact Kinde support with code 9865 if failures persist

Error code 9866

Link to this section

Description

• Collect payment details step — maximum attempts exceeded while validating billing details
• User-facing message: We couldn’t verify your billing details after several attempts. Please start a new session and try again, or contact support if you need help.

Troubleshooting

• Start a new sign-up session from your app’s entry point
• Ask the user to confirm billing name, address, and tax details match what their bank or card issuer expects
• Contact Kinde support if the user is blocked after a single valid attempt

Error code 9867

Link to this section

Description

• Collect payment details step — failed to prepare subscription parameters for the selected plan
• User-facing message: We couldn’t set up the selected plan. Please try again, or contact support if the problem continues.

Troubleshooting

• In the dashboard, confirm the plan exists, is published, and has valid pricing/features for the environment
• Try a different plan in a test environment to isolate plan configuration issues
• Contact Kinde support with code 9867 and the plan name or ID

Error code 9868

Link to this section

Description

• Collect payment details step — failed to create a subscription awaiting payment with the payment provider
• User-facing message: We couldn’t initialize your subscription payment. Please try again, or contact support if the problem continues.

Troubleshooting

• Check Stripe dashboard for errors on customer or subscription creation for that environment
• Confirm Stripe account is fully onboarded (not stuck in Connecting or In progress)
• Contact Kinde support with code 9868

Error code 9869

Link to this section

Description

• Collect payment details step — failed to attach the payment method to the customer in Stripe
• User-facing message: We couldn’t save your payment method. Please try again, or contact support if the problem continues.

Troubleshooting

• Ask the user to try a different card or payment method
• Check Stripe for declined cards, authentication requirements, or radar rules
• Contact Kinde support with code 9869

Error code 9870

Link to this section

Description

• Collect payment details step — failed to create a Stripe Setup Intent for collecting the payment method
• User-facing message: We couldn’t prepare the payment form. Please start a new session and try again.

Troubleshooting

• Start sign-up again from your application (do not resume a stale tab)
• Verify Stripe connection and that the environment’s billing configuration is complete
• Contact Kinde support with code 9870

Error code 9881

Link to this section

Description

• Error storing tokens with connected app

Troubleshooting

• Check the refresh token is valid