# Error codes (https://session-kit.pages.dev/docs/reference/error-codes)

Every error from Session kit's own logic is an `AuthError`. Match on its
`code`. The `message` is for people, and may change.

```ts title="src/error-codes.ts"
import { AuthError } from "@monarcode/session-kit";

export function isLocked(error: unknown): boolean {
  return error instanceof AuthError && error.code === "LOCKED";
}
```

How errors reach your app, and how to show them:
[Errors](https://session-kit.pages.dev/docs/configuration/errors).

## USER_VALIDATION_FAILED

The user couldn't be accepted. `issues` holds the schema's issues when it rejected the user, and `cause` holds the error when something else failed, such as an `updateUser` function. Otherwise `message` says why, such as a user that isn't a plain JSON object.

## INVALID_SESSION

Tokens or a saved session that can't be used, such as an access token that already expired at sign-in, or a saved session that's malformed. In the browser of a server-rendered app, your server answered with something other than a session or an access token.

## PERSISTENCE_FAILED

Storage couldn't be read, written or cleared, or `locking.seal` failed. In the browser of a server-rendered app, signing out on the server failed.

## REFRESH_FAILED

The refresh failed: your refresh callback threw or timed out, or there was no `refresh` option or refresh token to use. In the browser of a server-rendered app, reading the session or the access token from the server failed. On the server, the access token needed a refresh in a request that can't set cookies.

## REVOKE_FAILED

Your `revoke` callback failed. It shows in `state.error`, and `signOut()` still resolves.

## SESSION_CHANGED

The session changed while the call ran: a newer sign-in, a sign-out, or another tab replaced it.

## UNAUTHENTICATED

The call needs someone signed in, and no one is.

## LOCKED

The session is locked. Call `unlock()` first.

## UNLOCK_FAILED

`locking.open` failed, so the session stays locked.

## INVALID_OPTIONS

An option or argument Session kit can't use, or a method called without the option it needs or where it can't work, such as a server `signIn` in a request that can't set cookies.