# X_AUTH_LIMITER_NOT_SHARED

## Means

the app declared a fleet-wide credential throttle and the limiter keeps its counters per process

## Typical cause

`defineAuth({ rateLimit: { scope: 'shared' } })` against the built-in limiter, whose `scope` is `'process'` — account lockout would be `maxAttempts × replicas`, and a lockout on one replica invisible to the others. Refused at `defineAuth`, never at a request

## Fix

pass a shared `AuthLimiter` to `defineAuth({ limiter })`, or drop to `scope: 'process'`

[Auth and sessions](/error-codes#auth-and-sessions)