CHW-1101 InvalidCredentials

Default message: invalid credentials
HTTP status: 401 (client)

Problem. The identifier or password presented did not match a known user, or the user is disabled. Cause. Password login, SSO email match, or step-up check rejected the supplied credential — the handler deliberately cannot tell you which branch fired. Transient DB failures during the credential check are not masked as CHW-1101; they surface as CHW-5105 (HTTP 500) so a database outage cannot be misread as a wrong-password rate spike. Fix. Try again with correct credentials. If the password is lost, use the forgot-password flow. HTTP 401.

Passkey sign-in variant. A failed passkey (WebAuthn) sign-in also returns CHW-1101 — with the message “That passkey isn’t registered for an account here.” The usual cause is an orphaned passkey on the device: the browser or OS keychain still offers a credential from an earlier enrollment that the server never persisted (or whose account was since removed), so the device presents a passkey the backend has no record of. Re-enrolling does not fix this on its own — the stale credential stays in the device’s passkey manager and keeps getting offered first, so the next sign-in fails the same way. Fix.

1. Sign in with your password or an email sign-in link to get back in.
2. Delete the stale Chainsaw passkey from the device’s passkey manager, not just the dashboard:
   • macOS / iOS: Settings → Passwords → the chain305.com entry.
   • Chrome: Settings → Passwords → Passkeys.
   • A hardware security key: use the key vendor’s management tool.
3. Add a fresh passkey from Settings → Security in the dashboard.

Removing the server-side passkey alone (Settings → Security → Remove) is not enough while the device copy remains — clear it in both places before re-enrolling.