Who you are, what you are allowed to do, and every decision Quavern takes to refuse an access — whether a machine took it or a person did.
Find your code below — there are 48 of them. The digit between the letters and the dash says who can act on it: 1 is something you can change, 2 and 9 are Quavern's to fix, 3, 4 and 5 are decisions about access, 6 and 7 mean the service is in maintenance or has moved, and 8 points at the device or the network. SCTY uses 1, 2, 3, 4, 5, 7. The shape of a code is explained in How to read a Quavern support code.
Class 1 — Your request or your action
Check what you sent and the state of the account: the request itself, a quota, or the object it names. Correcting that and trying again is normally the whole fix.
SCTY1-1400 — passkey_invalid
What it means. Quavern refused the passkey: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
SCTY1-1401 — phone_code_invalid
What it means. Quavern refused the code sent by SMS: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
SCTY1-1404 — passkey_not_found
What it means. The request named the passkey, and Quavern holds no record of it: either it never existed, it was deleted, or it belongs to another account.
What to do. Check the identifier you sent, then check you are signed in as the account that owns it.
SCTY1-1409 — passkey_already_registered
What it means. The passkey is already in the state the request asked for, so Quavern did nothing rather than do it twice.
What to do. Nothing is broken. Read the current state before repeating the step.
SCTY1-2400 — phone_invalid
What it means. Quavern refused the telephone number: what arrived is not in the form this route accepts.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
SCTY1-2409 — passkey_limit_reached
What it means. The number of passkeys on this account already sits at the highest Quavern allows on this account or this plan, so one more was refused.
What to do. Remove one you no longer need, or move to a plan with a higher ceiling.
SCTY1-3400 — passkey_challenge_unknown
What it means. The passkey challenge is not one Quavern recognises.
What to do. Use one of the values the documentation lists.
SCTY1-3409 — phone_already_used
What it means. The telephone number has already been used, and Quavern accepts it once only.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
SCTY1-4400 — passkey_challenge_expired
What it means. The passkey challenge was genuine, but its lifetime has run out.
What to do. Start the step again to obtain a fresh value. Do not resend the old one.
SCTY1-4409 — stronger_factor_present
What it means. Quavern has not published what this code means. Its name does not settle it, and this page will not guess — the direction is ambiguous: the slug does not say whether a stronger factor blocks adding a weaker one, or blocks removing the stronger one.
What to do. Quote the code to support at [email protected], with the time and what you were doing, and you will be told what it means.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
SCTY1-5400 — reset_token_invalid
What it means. Quavern refused the password reset token: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
Class 2 — Quavern's server or one of its dependencies
Nothing you did caused it. Wait a moment and try again. If it keeps happening, send support the code and the time — that is what lets the incident be found in the logs.
SCTY2-1503 — sms_unavailable
What it means. The SMS sender Quavern uses did not answer, and this route cannot be served without it.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
Class 3 — Authentication, authorisation or security
Sign in again, or ask whoever administers your organisation for the access this needs. Support will never work around an access control on your behalf.
SCTY3-1401 — authentication_required
What it means. The request cannot go ahead without proof of who you are.
SCTY3-1403 — access_token_required
What it means. The request cannot go ahead without an access token.
SCTY3-1428 — authorization_pending
What it means. The authorisation you were asked to give has been started and is not finished. This is a waiting answer, not a failure.
What to do. Poll again after the interval the response gives, and do not start a second attempt in parallel.
SCTY3-2401 — invalid_token
What it means. Quavern refused the token: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
SCTY3-2403 — insufficient_scope
What it means. The credential used does not carry the scopes that this request needs.
What to do. Ask for a token with the right scopes, or for the access to be granted.
SCTY3-2404 — device_code_not_found
What it means. The request named the device code, and Quavern holds no record of it: either it never existed, it was deleted, or it belongs to another account.
What to do. Check the identifier you sent, then check you are signed in as the account that owns it.
SCTY3-3401 — invalid_credentials
What it means. Quavern refused the credentials sent: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
SCTY3-3403 — invalid_audience
What it means. Quavern refused the audience the token is for: what arrived is not in the form this route accepts.
SCTY3-4401 — invalid_refresh_token
What it means. Quavern refused the refresh token: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
SCTY3-4403 — invalid_scopes
What it means. Quavern refused the set of scopes requested: what arrived is not in the form this route accepts.
SCTY3-5401 — invalid_handoff
What it means. Quavern refused the hand-off ticket that moves a signed-in session between Quavern surfaces: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
SCTY3-5403 — invalid_target_client
What it means. Quavern refused the client the token was asked for: what arrived is not in the form this route accepts.
SCTY3-6401 — expired_handoff
What it means. The hand-off ticket that moves a signed-in session between Quavern surfaces was genuine, but its lifetime has run out.
What to do. Start the step again to obtain a fresh value. Do not resend the old one.
SCTY3-6403 — invalid_redirect_uri
What it means. Quavern refused the redirect URI: what arrived is not in the form this route accepts.
SCTY3-7401 — passkey_rejected
What it means. Quavern refused the passkey: the proof presented did not satisfy the check.
SCTY3-7403 — invalid_code_challenge
What it means. Quavern refused the PKCE code challenge: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
SCTY3-8401 — mfa_required
What it means. The request cannot go ahead without the second factor.
SCTY3-8403 — device_token_required
What it means. The request cannot go ahead without a device token.
SCTY3-9401 — mfa_invalid_code
What it means. Quavern refused the two-step verification code: what arrived is not in the form this route accepts.
SCTY3-9403 — access_blocked
What it means. Quavern refused the request on purpose. The caller is known to Quavern; it is not allowed through here.
Class 4 — An automated security or anti-abuse block
An automated protection stopped the request. Support cannot lift it on the spot; describe what you were doing and it will be put in front of the security team.
SCTY4-1401 — refresh_token_reused
What it means. The refresh token was presented a second time, after that value had already been spent. Quavern reads that as a leak and refuses the request.
What to do. Sign in again from the start. Anything still holding the old value should be signed out.
SCTY4-1403 — captcha_required
What it means. The request cannot go ahead without the CAPTCHA check.
SCTY4-1429 — slow_down
What it means. Requests arrived faster than Quavern accepts here. There is nothing wrong with what you sent.
What to do. Wait, then try again more slowly. Honour the Retry-After header when the response carries one.
SCTY4-2401 — invalid_mfa_challenge
What it means. Quavern refused the two-step verification challenge: the value received is not in the expected form, or it is not one Quavern issued.
What to do. Send the value exactly as it was given to you, with nothing added, trimmed or re-encoded.
SCTY4-2403 — captcha_failed
What it means. The CAPTCHA check did not pass. Quavern refused the request before anything changed.
SCTY4-2409 — device_code_used
What it means. The device code has already been used, and Quavern accepts it once only.
SCTY4-2429 — sms_rate_limited
What it means. Requests arrived faster than Quavern accepts here. There is nothing wrong with what you sent.
What to do. Wait, then try again more slowly. Honour the Retry-After header when the response carries one.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
SCTY4-3403 — signup_card_pending
Retired. Nothing raises this any more. It stays published because a code is never recycled and never changes meaning: a ticket quoting it from before it was withdrawn still resolves to what it meant then.
What it means. The card check asked for at sign-up has been started and is not finished. This is a waiting answer, not a failure.
What to do. Poll again after the interval the response gives, and do not start a second attempt in parallel.
*From the registry:* Retired: the free Stripe card check (docs/ACCOUNT_ACCESS.md §7) Removed on 2026-09-18 when a verified telephone number replaced the card authorisation. Nothing raises these any more. They stay listed because a code is never recycled and never changes meaning after publication (docs/ERROR_CODE_POLICY.md, stability rule 4): a support ticket quoting STRP1-1402 from last month must still resolve to what it meant then.
SCTY4-3429 — mfa_too_many_attempts
What it means. Too many attempts in a row failed, so Quavern stopped accepting them for a while.
What to do. Wait before trying again, and use a value you know is current rather than guessing.
SCTY4-4403 — phone_required
What it means. The request cannot go ahead without a verified telephone number.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
Class 5 — A block or ban decided by a person
A person at Quavern took this decision. Write to support: only a review can change it, and no automatic retry will.
SCTY5-1403 — account_disabled
What it means. The account is blocked. Every request that depends on it will be refused until that is lifted.
SCTY5-2403 — organization_blocked
What it means. The organisation is blocked. Every request that depends on it will be refused until that is lifted.
SCTY5-3403 — access_denied
What it means. Quavern refused the request on purpose. The caller is known to Quavern; it is not allowed through here.
Class 7 — Stopped, moved, or an update is required
What you called has stopped, moved, or needs a newer version. Follow the migration or update notice rather than retrying.
SCTY7-1410 — device_code_expired
What it means. The device code was genuine, but its lifetime has run out.
What to do. Start the step again to obtain a fresh value. Do not resend the old one.
SCTY7-2410 — phone_code_expired
What it means. The code sent by SMS was genuine, but its lifetime has run out.
What to do. Start the step again to obtain a fresh value. Do not resend the old one.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
SCTY7-3410 — reset_token_expired
What it means. The password reset token was genuine, but its lifetime has run out.
What to do. Start the step again to obtain a fresh value. Do not resend the old one.
*From the registry:* Telephone verification, the SMS factor and password reset docs/ACCOUNT_ACCESS.md §8. Each is reachable from exactly one condition. A wrong code is SCTY1-*401 (a client mistake) and a required telephone is SCTY4-*403 (an automated enforcement decision) because the SCTY3-*401 and SCTY3-*403 families are full — the class table in docs/ERROR_CODE_POLICY.md puts them where the cause is, not where the HTTP status is. There is deliberately no phone_not_verified: one condition, one code.
Still stuck
Write to [email protected] with the code, the reason, the time with its time zone, and the route you called. Never send a password, a token, an API key or full card details — support will never ask for any of them.
Quavern help reference: support-codes-scty/en