Errors

Kernia errors are returned as structured JSON with a stable code, message, HTTP status, and optional field details. Browser redirects may also land on an error page with the same code in the URL.

Shape

{
  "code": "STATE_MISMATCH",
  "message": "OAuth state verification failed",
  "status": 400
}

Known errors

• Invalid code
• No code
• State mismatch
• Unable to create session
• Unable to create user
• Unknown

Client handling

Clients should branch on code, not on localized message text. Admin and demo pages should render a human-readable state and keep the raw code available for diagnostics.

Logging

Server logs should include request id, route, provider, status, and error code. Do not log passwords, OTPs, OAuth codes, state values, session cookies, API keys, webhook secrets, or provider tokens.

Test coverage

Route tests should assert the HTTP status, stable code, response shape, and absence of leaked secrets.