Troubleshoot user import errors

When you import users in bulk from a file, Kinde checks to see if there are errors that will prevent a new user record from being created or updated.

Common errors include:

• Duplicate records (based on the ID or email)
• Invalid email
• Missing or invalid information
• An organization, role, or permission does not exist in Kinde.

You can view the error log immediately after you import to review any errors.

To view errors

Link to this section

After the import, you have the option to view the error list. This will tell you which items are in error.

1. In the file, find the error and correct it.
2. Re-import the file.
3. If you cannot correct an error, you may want to add the user manually, which will trigger a password reset the next time they sign in.

If you find any errors you cannot resolve, contact our support team.

Fixing errors

Link to this section

The best appraoch is to fix errors in the file and then import the users again. For JSON format imports, we recommend using a JSON validator tool to check for errors.

• You can re-import as many times as you need to.
• You don’t need to delete records that have already been imported.
• Kinde ignores any information that exists already, unless you made any changes to it.

Password errors

Link to this section

When importing passwords, Kinde will look for a user matching the ID or email address in the user details file. We will let you know if a match is not found, if the hashing algorithm is not supported, or related columns are incorrect.

Users whose passwords cannot be imported will be prompted to reset their password once you switch on the connection.

Firebase scrypt password errors

Link to this section

If you’re importing firebase-scrypt passwords, each of the four Firebase hash parameters is validated per row:

• Invalid signer key (INVALID_SIGNER_KEY) — the signer_key column is missing or is not valid base64. Copy the signer key exactly as shown in your Firebase project’s password hash parameters.
• Invalid salt separator (INVALID_SALT_SEPARATOR) — the salt_separator column is missing or is not valid base64. This is usually the short value Bw==.
• Invalid rounds (INVALID_ROUNDS) — the rounds column is missing or outside the range 1–16.
• Invalid mem cost (INVALID_MEM_COST) — the mem_cost column is missing or outside the range 1–20.

These four values come from the Firebase console: Authentication > Users > ⋮ > Password hash parameters. They are project-wide, so the fix usually applies to every failed row at once. Correct the values in your file and re-import.

ASP.NET Identity password errors

Link to this section

When you use the ASP.NET Identity import type or the aspnet-identity-v2 hashing method, a password validation error prevents the entire row from being imported. Fix the file and re-import the row.

• The password hash is invalid — the password field must contain a valid ASP.NET Identity v2 hash. This is PasswordHash for the ASP.NET Identity import type, or hashed_password for Custom CSV. V2 hashes are 68 base64 characters and decode to 49 bytes. ASP.NET Core Identity v3 hashes are longer and typically start with AQAAAA; Kinde cannot verify them. A value can also become invalid if it is truncated or reformatted in a spreadsheet. To import the user without a password, clear the applicable password-hash field. They can then set a password when they first sign in.
• The hashing configuration is invalid — do not provide salt, salt_position, iterations, or variant with aspnet-identity-v2. These values are embedded in the hash, so clear the corresponding fields.
• The row has no login identity — a row with a password must also have an email, phone number, or username. Add a login identity or remove the password.

File encoding errors

Link to this section

If the whole import fails before rows are processed, check the file encoding. Kinde accepts CSV and NDJSON files encoded as UTF-8 or UTF-16 with a byte order mark (BOM). Other encodings, including Windows-1252 and Latin-1, are rejected to prevent corrupted names and email addresses.

Re-save the file as UTF-8 or BOM-marked UTF-16 and import it again. In SQL Server Management Studio, choose one of those encodings when saving the results. With bcp, use -w for UTF-16 or -c -C 65001 for UTF-8.

Bad data from previous provider

Link to this section

If there are a lot of errors, you may need to go back to your old auth provider to get a new file.

Importing users with organization IDs, roles, or permissions

Link to this section

Organizations, roles, and permissions need to exist in Kinde before you bring these details in as part of a user import.

If an organization match is not found in Kinde, the user will be added to the default organization. To correct this, you may need to add them to others manually, or re-import.

Similarly, if the role or permission key does not exist in Kinde exactly the way you referenced in the CSV, then the user might not be assigned the role or permission.