Fix guides / Supabase: "Invalid login credentials"

How to fix Supabase "Invalid login credentials"

Your login form calls supabase.auth.signInWithPassword() and gets AuthApiError: Invalid login credentials with status 400, even for an account you are sure exists. Supabase deliberately uses one vague message for several different problems, so here is how to tell them apart.

Why it happens

• The user is in a different Supabase project. You signed up in the preview, which points at one project, and you are logging in on the deployed site, which points at another. Very common after connecting a new project in Lovable or Bolt.
• The account has no password. The user first signed in with Google, GitHub, or a magic link, so there is no password to match.
• The user was inserted by SQL. AI builders sometimes seed test users straight into auth.users with a plain text or badly hashed password. Those rows can never log in with a password.
• The inputs are not what you think. A trailing space from autofill, the username field sent as the email, or the form state not updated before submit.
• The password really is wrong. Supabase returns the same message for an unknown email, so the person may also have a typo in the address.

Note: if the email exists but is unconfirmed, you get a different error. See the Email not confirmed guide.

Step 1: confirm the project

Compare the URL in your deployed environment variables (VITE_SUPABASE_URL or NEXT_PUBLIC_SUPABASE_URL) with the project open in your dashboard. Then open Authentication, then Users, and search for the email. If it is not there, the account lives in another project.

Step 2: check how the user signs in

In the Users list, look at the provider for that user. If it shows Google or another OAuth provider only, show a "Continue with Google" button, or send a password reset so they can set a password.

Step 3: replace SQL-seeded users

Delete users that were inserted by hand and create them the supported way, from a trusted server or script with the service role key (never in the browser):

const { data, error } = await supabaseAdmin.auth.admin.createUser({
  email: 'test@example.com',
  password: 'a-strong-password',
  email_confirm: true,
});

Step 4: clean the inputs

const { error } = await supabase.auth.signInWithPassword({
  email: email.trim().toLowerCase(),
  password,
});
if (error) console.log(error.status, error.message);

Log the exact payload once in development to be sure the email field holds an email and the password is not empty.

Check the fix

1. Create a fresh account on the deployed site and log in with it.
2. Use "Forgot password" on an old account, set a new password, and log in.
3. The request to /auth/v1/token?grant_type=password in the Network tab returns 200.

Last updated 2026-10-21.