Kyvernon

Reference For: administrators, users, tenants, developers

Password errors

Causes and remedies for the error codes of the password policy and of password changes.

error.password_rotation_required

Text in the console
The password of this account must be changed before anything else works. Change it and try again.
Meaning for API clients
The session is restricted until the password is changed.
Code
FAILED_PRECONDITION, HTTP 412
ArgumentWhat it holds
reasonwhy the session is restricted, here password_rotation_required.

Cause. The password of the account must be changed before the session can do anything else. An administrator set the account to require a new password at the next sign-in, or created it that way. Until the password changes, the API answers with this code for every operation except the password change.

Remedy.

  1. Change the password: Choose a new password, or kyvernon auth password. The current and the new password come from the environment variable KYVERNON_PASSWORD or from standard input.
  2. Repeat the operation.

error.password.too_short

Text in the console
The new password is too short. Use at least {min} characters.
Meaning for API clients
The password is shorter than min.
Code
INVALID_ARGUMENT, HTTP 400
ArgumentWhat it holds
minthe minimum number of characters.

Cause. The new password has fewer characters than the minimum of the password policy. The minimum is 12 characters, and an administrator can set a higher one.

Remedy.

  1. Use a longer password or passphrase. A passphrase of several words is easier to remember than a short password with symbols.
  2. Repeat the change.

error.password.too_long

Text in the console
The new password is too long. Use at most {max} characters.
Meaning for API clients
The password is longer than max.
Code
INVALID_ARGUMENT, HTTP 400
ArgumentWhat it holds
maxthe maximum number of characters.

Cause. The new password has more characters than the maximum of the password policy. The maximum is 256 characters.

Remedy.

  1. Use a shorter password.
  2. Repeat the change.

error.password.common

Text in the console
This password is too common or too easy to guess. Choose a longer passphrase.
Meaning for API clients
The password is on the common-password list.
Code
INVALID_ARGUMENT, HTTP 400

Cause. The password is on the list of common passwords, or is a common word with digits, symbols or letter substitutions added to it. An administrator can add words to the list.

Remedy.

  1. Choose a longer passphrase that is not a known word or phrase.
  2. Use a password manager to generate one.

error.password.repetitive

Text in the console
The password repeats one character or group. Choose a longer passphrase.
Meaning for API clients
The password repeats one character or group.
Code
INVALID_ARGUMENT, HTTP 400

Cause. The password has fewer than four different characters, for example one character or one short group repeated.

Remedy.

  1. Choose a longer passphrase with more variation.
  2. Repeat the change.

error.password.sequential

Text in the console
The password is a keyboard or alphabet sequence. Choose a longer passphrase.
Meaning for API clients
The password is a keyboard or alphabet sequence.
Code
INVALID_ARGUMENT, HTTP 400

Cause. The password is a run of keys that follow each other on the keyboard, or a run of the alphabet or of digits.

Remedy.

  1. Choose a longer passphrase that does not follow the order of the keyboard or the alphabet.
  2. Repeat the change.

error.password.contains_username

Text in the console
The new password must not contain your user name.
Meaning for API clients
The password contains the user name.
Code
INVALID_ARGUMENT, HTTP 400

Cause. The new password equals the user name, or contains it. User names of four characters or more are checked as part of the password.

Remedy.

  1. Choose a password that does not contain your user name.
  2. Repeat the change.

error.password.unchanged

Text in the console
The new password must differ from the current one.
Meaning for API clients
The new password equals the current one.
Code
INVALID_ARGUMENT, HTTP 400
ArgumentWhat it holds
fieldthe request field that holds the rejected password, here password.

Cause. The new password is the same as the current one.

Remedy.

  1. Choose a password that you have not used for this account.
  2. Repeat the change.

error.password.current_required

Text in the console
Enter your current password.
Meaning for API clients
The current password must be given.
Code
INVALID_ARGUMENT, HTTP 400
ArgumentWhat it holds
fieldthe request field that is missing, here currentPassword.

Cause. A password change that you make for your own account needs your current password, and the request did not carry it.

Remedy.

  1. Enter your current password: Current password.
  2. With the CLI, kyvernon auth password reads the current and the new password from KYVERNON_PASSWORD or standard input.
  3. When you have forgotten the password, an administrator sets a new one: kyvernon users set-password <username>.

error.password.current_incorrect

Text in the console
The current password is not correct. Check it and try again.
Meaning for API clients
The current password is wrong.
Code
INVALID_ARGUMENT, HTTP 400
ArgumentWhat it holds
fieldthe request field that holds the rejected password, here currentPassword.

Cause. The current password that you gave does not match. Repeated wrong attempts are slowed down in the same way as wrong passwords at sign-in.

Remedy.

  1. Check the current password and try again.
  2. When you have forgotten the password, an administrator sets a new one: kyvernon users set-password <username>.

Version 0.1. Last changed: 2026-11-13