--- title: "Authentication Troubleshooting" description: "Comprehensive guide to fixing login, OAuth, and session issues" category: "troubleshooting" lastUpdated: "2025-11-01" --- # Authentication Troubleshooting Having trouble logging in or staying logged in? This guide covers every authentication scenario, from email/password issues to OAuth problems. --- ## Can't Sign In with Email & Password ### Invalid Credentials Error **Most common causes**: 1. **Email typo** - Check spelling carefully 2. **Wrong password** - Even if you're sure, try "Forgot Password" 3. **Account doesn't exist yet** - Click "Sign Up" instead 4. **Email not verified** - Check your inbox for verification email **Step-by-step fix**: ``` 1. Double-check email spelling (no extra spaces!) 2. Try copying/pasting your email from another source 3. Click "Forgot Password" to reset 4. Check spam folder for reset email 5. Follow link and create a NEW password 6. Try logging in with new password ``` ### Rate Limiting **Symptom**: After several failed login attempts, you see "Too many attempts. Please wait." **What happened**: Supabase Auth blocks repeated login attempts to prevent brute-force attacks. **How to fix**: - **Wait 60 seconds** before trying again - After waiting, you get 5 more attempts - If still failing, use "Forgot Password" instead **Don't spam the login button!** Each failed attempt counts toward the rate limit. Take your time and verify your credentials before clicking. ### Password Requirements When creating/resetting a password, it must: - Be at least **8 characters long** - Contain at least **one number OR one special character** (optional but recommended) - Not be a commonly-used password (e.g., "password123") **Pro tip**: Use a password manager like 1Password, Bitwarden, or your browser's built-in manager. --- ## Magic Link Not Arriving **Symptom**: You requested a magic link (passwordless login), but the email never arrived. ### Check These Places First 1. **Spam/Junk folder** - Email filters often flag magic links 2. **Promotions/Updates tab** (Gmail) - Check all inbox categories 3. **Email quarantine** (corporate email) - IT might be blocking them ### Email Delivery Timing - **Normal delivery**: 30 seconds to 2 minutes - **High traffic times**: Up to 5 minutes - **After 10 minutes**: Something's wrong, request a new link ### Common Email Provider Issues **Gmail**: - Check "All Mail" folder - Add `noreply@clearmorning.app` to contacts - Check Gmail filters (Settings > Filters) **Outlook/Office 365**: - Check "Junk Email" folder - Whitelist `@clearmorning.app` domain - Corporate accounts may block external auth emails (contact IT) **Apple Mail (iCloud)**: - Check "Junk" folder on iCloud.com (not just the Mail app) - Go to Settings > Privacy > Blocked to ensure Clear Mornings isn't blocked **Custom Domain Email**: - SPF/DKIM records might be blocking auth emails - Contact your email administrator - Use a personal email (Gmail/Outlook) for Clear Mornings instead ### Magic Link Best Practices - **Don't request multiple links** - Only the MOST RECENT link works - **Links expire after 60 minutes** - Check timestamp in email - **Click only once** - Clicking twice invalidates the link - **Use the same browser** - The link is tied to your browser session **Mobile Users**: If clicking a magic link in your email app doesn't work, copy the link and paste it into your mobile browser (Safari on iOS, Chrome on Android). --- ## OAuth Issues (Google, Apple, GitHub) ### Pop-up Blocked **Symptom**: You click "Sign in with Google" but nothing happens. **Fix**: ``` 1. Look for a "Pop-up blocked" icon in your address bar 2. Click it and choose "Always allow pop-ups from clearmorning.app" 3. Try signing in again ``` **Alternative**: Try in incognito/private mode (disables most pop-up blockers). ### Wrong Account Selected **Symptom**: OAuth opens, but you accidentally select the wrong Google/Apple account. **How to fix**: ``` 1. Log out of Clear Mornings completely 2. Go to your Google/Apple account settings 3. Remove Clear Mornings from "Connected Apps" 4. Try OAuth again - you'll get the account picker ``` ### Email Mismatch **Symptom**: "This email is already registered with a different login method" **What happened**: Your Clear Mornings account was created with email/password (or a different OAuth provider), but you're trying to log in with a mismatched OAuth provider. **Example**: - Account created with: `you@gmail.com` via email/password - Trying to log in with: `you@gmail.com` via Google OAuth - Result: ❌ Email mismatch error **Solution**: 1. **Use your original login method** - If you signed up with email/password, use that 2. **Link accounts** - Go to Settings > Connected Accounts after logging in 3. **Reset password** - If you forgot your password, use "Forgot Password" to reset ### Google OAuth Specific **"Access Blocked: This app's request is invalid"**: - Clear Mornings's OAuth app is misconfigured (rare) - Try email/password login instead - Report this to support immediately **"This app isn't verified"**: - Click "Advanced" > "Go to Clear Mornings (unsafe)" - This is safe - Google shows this for newer apps ### Apple OAuth Specific **"Sign in with Apple" not appearing**: - Only works on iOS 13+ and macOS 10.15+ - Update your device OS - Use email/password as fallback **Email Hidden with Relay**: - Apple creates a relay email like `abc123@privaterelay.appleid.com` - This is fine! Clear Mornings supports relay emails - Just make sure you can receive emails at that relay ### GitHub OAuth Specific **"OAuth App authorization error"**: - Your GitHub account email must be verified - Go to GitHub > Settings > Emails - Verify your primary email - Try OAuth again **Corporate OAuth Restrictions**: If you're using a work Google/Microsoft account, your IT department may block third-party OAuth apps. Use a personal email instead. --- ## Session Timeout Problems ### Unexpectedly Logged Out **Symptom**: You were logged in, but suddenly you're back at the login screen. **Why this happens**: - **Session expired** - Sessions last 7 days by default - **Security policy** - Inactive for 24+ hours triggers re-auth - **Multi-device conflict** - Logging in on device B logs you out of device A (rare) - **Cache cleared** - Browser/app cache clear removes session tokens **Prevention**: - Check "Remember me" on login (extends session to 30 days) - Don't clear your browser cache unless necessary - Whitelist `clearmorning.app` in your browser's cookie settings ### "Invalid Session Token" **Symptom**: Error message says "Your session is invalid or expired" **Instant fix**: ``` 1. Click "Log out" (if visible) 2. Hard refresh: Cmd+Shift+R / Ctrl+Shift+R 3. Log back in ``` **If that doesn't work**: ``` 1. Clear browser cache for clearmorning.app 2. Close ALL browser tabs 3. Open a fresh tab and go to clearmorning.app 4. Log in again ``` ### Token Refresh Failures **Symptom**: You're logged in but random actions fail with "Unauthorized" errors. **What's happening**: Your access token expired, and the automatic refresh failed. **Server-side debugging** (for developers): 1. Check browser DevTools > Network tab 2. Look for 401/403 responses on API calls 3. Check response headers for `WWW-Authenticate` errors **User fix**: - Log out and log back in - This forces a fresh token pair (access + refresh) **Access tokens expire after 1 hour**. Clear Mornings automatically refreshes them in the background. If you see auth errors after being idle for 60+ minutes, your refresh token might have expired too. --- ## Reset Password Not Working ### Email Not Arriving See [Magic Link Not Arriving](#magic-link-not-arriving) section above - same troubleshooting applies. ### Reset Link Expired **Symptom**: "This password reset link has expired" **Why**: Reset links expire after 60 minutes (security measure). **Fix**: Request a new password reset link. ### Reset Link Already Used **Symptom**: "This link has already been used" **Why**: You can only use a reset link once. **Fix**: - If you already reset your password, use the NEW password to log in - If you didn't reset yet, request a fresh link ### "New Password Too Weak" **Password requirements**: - Minimum 8 characters - At least one number OR special character (recommended) - Not in the "common passwords" blocklist **Common mistakes**: - ❌ "password" - Too common - ❌ "12345678" - Too common - ❌ "MyName123" - Too predictable - ✅ "ClearMorning2025!" - Strong! --- ## Multi-Device Sync Issues ### Logged Out on Other Devices **Symptom**: You log in on your phone, and your desktop session ends. **Why this might happen**: - **Security setting triggered** - If enabled, "Log out other sessions on new login" - **Session conflict** - Rare, but can happen if sessions clash **Not normal behavior**: Clear Mornings SHOULD support multiple simultaneous sessions. If this happens repeatedly: 1. Clear browser cache on ALL devices 2. Log in on primary device first 3. Then log in on secondary devices 4. Contact support if it persists ### Different Data on Different Devices **Symptom**: Your habits/food logs look different on phone vs. desktop. **Possible causes**: 1. **Sync delay** - Give it 10 seconds to sync 2. **Offline mode** - One device is offline 3. **RLS policy bug** - Row Level Security is blocking sync 4. **Cached data** - Old data stuck in browser cache **Troubleshooting steps**: ``` 1. Hard refresh on BOTH devices 2. Check internet connection on BOTH devices 3. Log out and back in on ONE device 4. Wait 30 seconds 5. Check if data synced ``` **Critical Data Mismatch**: If habits on one device don't exist on another, this is a serious sync issue. DO NOT delete data. Contact support immediately with screenshots from both devices. --- ## Account Locked or Suspended ### "Your account has been disabled" **Why this happens** (extremely rare): - Violation of Terms of Service - Fraudulent payment detected - Abuse of API rate limits - Compromised account (security lockdown) **What to do**: 1. **Don't create a new account** - This can make it worse 2. **Contact support immediately** - support@clearmorning.app 3. **Provide details**: Your email, when you noticed the lockdown, what you were doing **Typical resolution time**: 24-48 hours ### "Too many devices" Clear Mornings doesn't have a device limit. If you see this error: - This is a bug - Contact support with your device list - Workaround: Log out of unused devices --- ## SSR Authentication Pattern (Technical) **For developers debugging auth issues in the codebase:** Clear Mornings uses Next.js 14+ with SSR (Server-Side Rendering). Client and server use **DIFFERENT** Supabase clients. **Common mistake**: ```typescript // ❌ WRONG - This breaks production! 'use client'; import { createClient } from '@/lib/supabase/server'; ``` **Correct pattern**: ```typescript // ✅ Client Components 'use client'; import { getSupabaseClient } from '@/lib/supabase'; // ✅ Server Components import { createClient } from '@/lib/supabase/server'; ``` **If you see auth errors after form submission**, check: 1. Is the component using `'use client'`? 2. Is it importing from `@/lib/supabase/server`? 3. If yes to both: **THAT'S THE BUG**. Switch to `getSupabaseClient()`. --- ## Emergency: Completely Locked Out If you've tried everything and still can't log in: ### Nuclear Option: Fresh Start ``` 1. Open browser in Incognito/Private mode 2. Go to clearmorning.app 3. Click "Sign Up" (not "Log In") 4. Use a DIFFERENT email (e.g., add "+test" like: you+test@gmail.com) 5. If THIS works, your original account may be corrupted 6. Contact support to merge accounts ``` ### Data Recovery **Your data is safe!** Even if you can't log in: - All data is stored in Supabase (server-side) - Not stored in your browser - Support can help recover your account **To expedite recovery, provide**: - Original email address - Approximate account creation date - Last successful login date - Payment email (if you're a paid subscriber) --- ## Still Having Issues? - **[Common Issues & Solutions](/kb/troubleshooting/common-issues)** - Start here for general problems - **[Data Privacy & Security](/kb/troubleshooting/data-privacy)** - RLS, data export, account deletion - **[Contact Support](/support)** - We're here to help! **Response Times**: - Email support: 24-48 hours - Discord community: Usually within 2-4 hours - Urgent security issues: priority@clearmorning.app (12-hour response)