Document typed managed auth outcomes

[masnwilliams]

summary

• document exact unattended reauth blocker codes and recovery actions
• distinguish rejected authenticator codes from invalid usernames or passwords
• clarify that one rejected TOTP code does not prove the stored secret is stale

dependency

Merge after kernel/kernel#3666 is deployed.

validation

• mintlify broken-links
• rendered /auth/connection-lifecycle and /auth/programmatic locally

---

Note

Low Risk
Documentation-only changes to auth guides; no runtime or API code in this repo.

Overview
Expands Managed Auth docs so unattended reauth failures are described with specific terminal error_code values and matching recovery steps, aligned with the upcoming API behavior (post kernel#3666).

On connection lifecycle, the failure table now distinguishes credentials_invalid (username/password) from totp_code_rejected, and adds codes for MFA and human-only blockers (totp_required, sms_code_required, email_code_required, account_choice_required, customer_input_required, external_action_required). The Recovering section adds guidance for each—e.g. retry TOTP in a new window without assuming a stale secret on one rejection, use interactive login for SMS/email/account choices, and that Kernel won’t guess identities or trigger external approvals during unattended reauth.

On programmatic flow, the rejected-credential note now says unattended reauth surfaces the exact terminal code (e.g. totp_code_rejected), not only credentials_invalid.

^{Reviewed by Cursor Bugbot for commit 2722cb3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Kernel	🟢 Ready	View Preview	Aug 29, 2026, 8:34 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cursor]

Risk assessment: Very Low

Approved.

This diff only edits two Mintlify auth guides (auth/connection-lifecycle.mdx, auth/programmatic.mdx): +12 / −2. It adds documented error_code rows and recovery copy, and tightens one sentence about unattended reauth terminal codes.

• No application, API, or infrastructure code changed
• No config, CI, navigation, or OpenAPI updates
• No CODEOWNERS file and branch rules do not require code owner review
• Blast radius is docs copy only; no production logic or shared systems

Safe to approve under the Very Low documentation-only criteria.

  

_{Sent by Cursor Automation: Assign PR reviewers}