# X_SAML_RESPONSE_INVALID

## Means

a saml response failed its signature, wrapping, audience, recipient, time, InResponseTo or replay check

## Typical cause

the IdP signing certificate rotated, the SP entity id or ACS URL differs from what the IdP has configured, the clocks are skewed, or the response was tampered with or replayed

## Fix

`edit the samlIdentityProvider({ metadata, spEntityId, acsUrl }) call: paste the IdP current metadata XML and the entity id and ACS URL the IdP application is configured with`

[Auth and sessions](/error-codes#auth-and-sessions)