If you just want my solution without reading the details of my issue just jump to the end paragraph with the bold “FIX”.
I’ve seen a number of topics about " Login attempt or request with invalid authentication" with many different solutions:
I was having the exact same issue and no amount of proxy configuration was fixing the error. My external URL is supported through Cloudflare and a reverse proxy container (Unraid > SWAG docker) external to HA. I was assuming it was a config error with this setup as I had errors even after forwarding trusted proxies:
# Reverse Proxy http: use_x_forwarded_for: true trusted_proxies: - "IP of reverse proxy host"
For some reason the external URL kicked back the invalid login attempt notification almost every time I opened the android app. The notification referenced the Cloudflare servers and my device in the header but for some reason it wasn’t recognizing it as valid.
The FIX for my issue was actually moving my vacuum card from the main Lovelace screen to another tab (Neato Botvac on a custom vacuum card through HACS). I’m assuming integrations that use external URL’s (cameras, vacuums, etc.) get loaded on the home page before the login is verified and then kicks out the error notification (My apologies for being general. I’m not very familiar with code and networking terms). This may not be the final solution for everyone’s errors but hopefully this helps someone having the same scenario as me!
Special thanks to @va77 for the post that guided me towards this solution: Login attempt failed from iOS device - #48 by va77