# X_AUTH_LIMITER_POLICY_MISMATCH

## Means

a custom credential limiter enforces different numbers than the app declared

## Typical cause

`defineAuth({ limiter })` where the limiter's own `policy` disagrees with the declared `rateLimit` on `maxAttempts`, `windowMs` or `lockoutMs`. `Auth.rateLimit` is what an operator reads as "what this deployment enforces", and an injected limiter could leave nothing behind it. The `cause` names both numbers and says which half is likely wrong; `maxKeys` is deliberately **not** compared, since it bounds one process' table and a shared limiter has no opinion on it

## Fix

construct the limiter with the declared number — the declaration is what `Auth.rateLimit` reports, so it is the half that stays. If the limiter's number is the one this deployment means, change the declaration instead; `meta` carries `{ field, declared, enforced }`

[Auth and sessions](/error-codes#auth-and-sessions)