The short answer
Whizi access problems fall into four groups: the sign-in attempt itself failed, the browser could not get a fresh session token, another session is already open, or the account sharing guard refused the request. The message tells you which one, and each message below is quoted from the code that produces it.
The five below cover sign-in, session, single-session and sharing refusals:
| Message | What triggered it | Fix |
|---|---|---|
Login failed. Please check your credentials. | The sign-in attempt returned a status other than complete | Re-enter the email and password, or reset the password |
Invalid or expired session token. | HTTP 401. Token verification failed for any reason: expired token, bad signature, wrong issuer | Sign out and sign in again |
Authentication required. | HTTP 401. The request carried no Bearer token in the Authorization header | Sign in again |
Please sign out from other sessions and try again. | The sign-in error text contained "single session mode" | Sign out of Whizi in the other browser or tab, then retry |
Account sharing limit reached. Please use your own Whizi account. | HTTP 403. More than 3 distinct device or session keys were seen on the account in the last 24 hours | Use your own account. The window is rolling, so otherwise the only option is to wait |
Every authentication failure from the backend carries code unauthorized with HTTP 401. On the chat page and in the share modal the backend message is shown verbatim, so the string in a network trace and the string on screen are the same string there.
What "session expired" actually means
It means the page asked for a fresh session token and did not get one. That single condition surfaces under a different sentence depending on where you were when it happened.
| Where you see it | Message |
|---|---|
| Any backend call with no token | Authentication required. |
| Any backend call whose token fails verification | Invalid or expired session token. |
| A token that verifies but is missing a claim | The Clerk user_jwt token must include sub and email claims. |
| Chat list, chat load, delete, rename or upload | Failed to retrieve session token. |
| Side by side compare, at send time | Your session expired. Please refresh and try again. |
| Importing a ChatGPT or Claude export | Your session ended. Sign in again, then start the import. |
| Settings, before a cancellation | Authentication failed. Please sign in again. |
| The upgrade modal, before checkout | Authentication failed. Please sign in again. |
| The share modal | Not signed in. |
| The voice overlay | Sign in to Whizi to use voice mode. |
| The session call itself | Failed to fetch session ({status}). |
Sign out and sign in again. Two of the strings say so themselves: Your session ended. Sign in again, then start the import. and Authentication failed. Please sign in again.
Sign-in and password reset errors
Authentication and account management are provided by Clerk, so these strings come from the sign-in flow rather than from a Whizi password store.
| Message | Trigger condition |
|---|---|
Login failed. Please check your credentials. | The sign-in attempt returned a status other than complete |
An error occurred during login. | The sign-in call threw and no readable message came back |
Please sign out from other sessions and try again. | The error text contained "single session mode" |
Failed to authenticate with social login. | The Google redirect handoff threw before leaving the page |
Please enter your email address. | The password reset form was submitted with an empty email field |
Failed to send reset email. Please try again. | The password reset request threw |
Current password is required. | The current password field was empty on the reset password page |
Passwords do not match. | The two new password fields differ |
Failed to reset password. Please try again. | The reset failed and returned no readable message |
Please sign out from other sessions and try again. is the only one on that list whose fix is somewhere else: close the other tab or browser where Whizi is signed in, then retry here.
The Settings page has its own copy of the reset flow, with the same two strings: Please enter your email address. when the field is empty and Failed to send reset email. Please try again. when sending fails. Retrying is the whole fix. If it keeps failing, contact support rather than creating a second account.
Retrying in a tight loop can also hit the rate limiter, which answers HTTP 429 with Too many requests. Please wait and try again. The windows behind that string are in Whizi rate limits.
Sign-up and email verification errors
| Message | Trigger condition |
|---|---|
Registration service is not available. | The sign-up object was not ready when the form was submitted |
Registration failed. Please check your information. | The sign-up call threw with no readable message |
Verification service is not available. | The email code step ran with no sign-up object |
Verification failed. Please try again. | The verification attempt returned a status other than complete |
Invalid verification code. Please check your email. | The verification call threw |
Could not start Google sign-up. Please try again. | The Google sign-up redirect threw |
Missing session token after social signup. | No token was available after a social signup completed |
Your account was created, but checkout could not start. Please sign in and choose your plan again. | A registration carrying a pending checkout could not get a token afterwards |
The last one is not a failed signup: the account exists, and only the pending checkout was lost. What to do next is in card declined or payment failed at checkout.
The two "not available" strings mean the Clerk sign-up object was not ready when the form was submitted, rather than that your details were rejected. Wait for the page to finish loading, then submit again.
Temporary email addresses are refused
Temporary email addresses are not allowed. Please use a permanent email address. is HTTP 403 with code disposable_email_blocked. It is raised at account creation when the email domain is on the disposable list.
Accounts that already exist are unaffected by the list. The fix is a permanent address, and there is no override to request.
The same string can also come back at checkout with a different status. That side of it is covered in card declined or payment failed at checkout.
Account sharing limit reached
Account sharing limit reached. Please use your own Whizi account. is HTTP 403 with code account_sharing_limit. It fires when more than 3 distinct device or session keys have been seen on one account in the last 24 hours.
Ordinary multi-device use is expected and supported: an account can be signed in on more than one device, and both reach the same backend and the same conversation store. Only one generation runs per account at a time, enforced by a per-user lock, so two devices can never generate at once on one account.
There is no setting for this and no self-serve reset. The window covers the last 24 hours, so it clears on its own as older device keys age out. If you are one person on more than three browsers or devices in a day and you keep hitting it, contact support rather than trying to work around it.
Signed in, but Whizi says the account is not there
User not found. is raised when the users row behind a session has been deleted. The checkout route returns the same string as HTTP 404 not_found when it cannot read the caller row.
Account deletion is a two-step confirmation in Settings, and it removes the live Whizi account record, synchronized chats and messages, uploaded and generated media, saved mobile memory, referral records, mobile entitlement and usage state, rate-limit state, push tokens, and the Clerk authentication account, subject to the limited retention set out in the privacy policy.
If you see this and did not delete anything, contact support. There is no self-serve repair for it. What deletion covers in full is in what Whizi does with your data.
Guest profiles and linking
Guest use is signed-out use. Creating an account is optional in the mobile app, and continuing without one creates an anonymous, device-bound guest profile that needs no name or email address. It has its own set of access errors.
| Message | Trigger condition |
|---|---|
A valid guest session is required. | HTTP 401. The guest token is absent, malformed, or names a guest profile that does not exist |
This guest profile has already been linked. Sign in to continue. | HTTP 409. The guest token resolves to a profile already claimed by a different account |
This guest profile is linked to a different Whizi account. | HTTP 409. The claim targets a guest profile already bound elsewhere |
Wait for the current reply to finish, then try creating your account again. | HTTP 409. The profile was claimed while a generation was still running |
Only the last one has an easy fix: wait for the reply to finish, then create the account. The other three mean the guest profile is already bound to an account, so sign in to that account, or contact support if you do not recognize it.
Guest data is not stranded by this. Data export works for guest sessions too, because guests hold real chats and memory that are worth getting out.
When the account itself will not do something
These are account-level failures shown in Settings rather than sign-in failures.
| Message | What it is |
|---|---|
Your account could not be deleted. Please try again, or contact support. | The deletion request failed, shown in Settings |
Account deletion failed ({status}). | The raw error behind that toast, with the HTTP status |
Failed to export your data. Please try again. | The data export failed, shown in Settings |
Export request failed ({status}). | The raw error behind that toast |
Data export is rate limited to 5 requests per minute, because an export reads everything the account owns. Retrying faster than five times a minute will be refused by that limit.
There is no public or developer API, no API key issuance, and no personal access tokens. Every route authenticates as an end user session, so there is no key to rotate, revoke or paste when access breaks. If a script or third-party tool cannot reach your account, that is why.
- A session error means the request carried no usable token: sign out and sign in again
- Invalid or expired session token is HTTP 401 with code unauthorized
- A single session message means the other Whizi tab has to sign out first
- The account sharing guard trips above 3 device or session keys in 24 hours, and clears on its own
- Disposable email domains are refused at signup as HTTP 403 disposable_email_blocked
- User not found means the account record behind the session is gone: contact support
- A 429 means a rate limit window refused the request, so wait rather than retrying in a loop
- There are no API keys or personal access tokens to rotate
Frequently asked questions
Will resetting my password clear Invalid or expired session token.?
No. That string is returned when JWT verification against the Clerk JWKS throws, so it is about the token the browser is carrying rather than the password on the account. The password reset flow has its own separate strings, including Current password is required. and Passwords do not match. Sign out and sign in again instead.
Is Failed to retrieve session token. a Whizi outage?
It is not a backend refusal. The website throws it itself whenever getToken returns nothing before a chat list, chat load, delete, rename or upload call, so it carries no HTTP status and no error code. The backend equivalents, which do carry a status, are Authentication required. and Invalid or expired session token., both HTTP 401 unauthorized.
What does Failed to fetch session ({status}). mean, and what is the number in it?
It is the raw error thrown by the website when the session call itself fails, with the HTTP status of that call filled in where {status} sits. It is not a message written for readers, which is why it looks like an internal string. Quote it with the number intact when you contact support.
I cannot get in at all and none of these strings match. What now?
Contact support and paste the exact text you saw, along with what you were doing at the time. Each of these strings maps to one place in the code, so the verbatim wording is the fastest thing support has to work with. There is no self-serve account unlock.