# X_ACCOUNT_LOCKED

## Means

per-ip, per-account or per-org bucket is inside its lockout

## Typical cause

repeated failed attempts — password or second-factor code. `cause` names the caller's own key (an address or an email) and the seconds left; a locked **org** is never named, because its id was looked up from the address the caller typed. The wiki used to name `x auth unlock <key>`, a command that has never existed

## Fix

wait out the seconds `cause` names — or clear this one bucket: `await auth.limiter.recordSuccess('<key>')`, `await auth.orgLimiter.recordSuccess(orgKey(user.orgId))` for a tenant — or raise `defineAuth({ rateLimit })`. Never `reset()`: it drops every bucket in the table, including the spray this lockout is holding

[Auth and sessions](/error-codes#auth-and-sessions)