Reference
Errors
Every Authio response carries a stable code in addition to an HTTP status. Branch on the code, not the message.
| Code | Status | Where | Description |
|---|---|---|---|
missing_api_key | 401 | Management API auth | No Bearer token provided. |
invalid_api_key | 401 | Management API auth | Token unknown or revoked. |
missing_bootstrap_token | 401 | POST /v1/bootstrap | x-authio-bootstrap-token header is wrong. |
bootstrap_disabled | 503 | POST /v1/bootstrap | AUTHIO_BOOTSTRAP_TOKEN env var not configured on management-api. |
invalid_email | 422 | POST /v1/auth/magic-link/send, invitations | Email failed validation. |
invalid_destination | 400 | POST /v1/auth/magic-link/send | Destination is not a valid email or E.164 phone. |
invalid_slug | 422 | POST /v1/organizations | Slug must be lowercase alphanumeric with hyphens. |
slug_in_use | 409 | POST /v1/organizations | Another org in this project already uses that slug. |
organization_not_found | 404 | Org-scoped endpoints | No org with that id in this project. |
user_not_found | 404 | User-scoped endpoints | No user with that id in this project. |
membership_not_found | 404 | Membership endpoints | No membership matched the (project, org, membership) combo. |
not_a_member | 403 | POST /v1/sessions/(select|switch)-org | User does not have an active membership in the requested org. |
no_session | 401 | POST /v1/sessions/* | No active session cookie or Bearer token. |
token_consumed | 410 | Admin Portal | This setup link has already been used. |
token_expired | 410 | Admin Portal | Token TTL exceeded. |
token_invalid_or_expired | 410 | Admin Portal save | Token unknown, expired, or already consumed. |
unknown_provider | 404 | OAuth callback | Provider name not in the registry. |
missing_email | 400 | OAuth callback | Provider returned no email claim. |
verification_failed | 400 | Passkey verify | WebAuthn ceremony failed verification. |
unknown_or_expired_challenge | 400 | Passkey verify | Server-side challenge missing or expired (5 min TTL). |
db_unavailable | 503 | Anywhere | Postgres unreachable. |
Every response also carries an X-Request-Id header and a request_id field in the JSON body. Include it in any support email so we can find the trace.