# Authentication Troubleshooting {#authentication-troubleshooting}


Resolve login, JWT, and OAuth issues.


## Invalid Credentials {#invalid-credentials}


**Symptom:** `401 Unauthorized` on login

**Fixes:**

1. Verify email and password are correct
2. Check if user account is active
3. Verify the user exists in the database
4. Check `BCRYPT_SALT_ROUNDS` hasn't changed


## JWT Token Expired {#jwt-token-expired}


**Symptom:** `401` after some time

**Fix:** The token has expired. Refresh it or increase expiration:

```
JWT_TOKEN_EXPIRATION_TIME=86400  # 24 hours
```


## Refresh Token Invalid {#refresh-token-invalid}


**Symptom:** `401` on token refresh

**Fixes:**

1. Tokens are single-use; don't retry with spent tokens
2. Check `JWT_REFRESH_SECRET` matches the signing secret
3. Verify `JWT_REFRESH_EXPIRATION_TIME` hasn't passed


## Social Auth Callback Error {#social-auth-callback-error}


**Symptom:** OAuth login redirects to error page

**Fixes:**

1. Verify callback URL matches in OAuth provider settings
2. Check `GOOGLE_CALLBACK_URL` / `GITHUB_CALLBACK_URL` is correct
3. Ensure client secret hasn't been rotated


## Password Reset Failed {#password-reset-failed}


**Symptom:** `Password Reset Failed` error

**Fixes:**

1. Password must meet complexity requirements (8+ chars, uppercase, lowercase, number, special char)
2. Check SMTP is configured for reset emails
3. Verify the reset token hasn't expired


## Can't Login After Deploy {#cant-login-after-deploy}


**Symptom:** All users get 401 after deployment

**Fix:** `JWT_SECRET` must be the same across deployments. If changed, all existing tokens become invalid. Users must re-login.


## Related Pages {#related-pages}


- [Auth Endpoints](https://sourcey-gauzy.pages.dev/api/auth-endpoints/index.md) — auth API
- [JWT Authentication](https://sourcey-gauzy.pages.dev/authentication/jwt-authentication/index.md) — JWT details
- [Password Security](https://sourcey-gauzy.pages.dev/security/password-security/index.md) — password policies