BOTLOBBIESEpic Login Action Required: Preserve the Account and Check the Step
An Epic login error needs to be read in the context of the authentication step that failed. An action-required response, a failed session refresh and a rejection of account credentials are different signals. They should not all lead to deleting the saved account. Preserve the account information while you identify the exact error and follow any instructions provided directly by Epic.
Recognize corrective action without guessing its cause
The error name corrective_action_required indicates that the Epic flow requires an action before it can continue. If diagnostic information also shows code 18206, retain the code and the name together. Do not assign a specific cause, such as a particular agreement, unless Epic actually shows that requirement for the account.
Open Epic's own sign-in flow through a trusted route and inspect the account's instructions. Avoid copying a private continuation link into public chat. If you cannot complete the indicated step, report which stage is blocked without exposing the authorization URL or any values embedded in it. Note whether the message appeared during initial linking, Fortnite sign-in or session renewal. That distinction is useful even when the visible HTTP response is the same broad error status.
A refresh-token error concerns a session
An invalid_refresh_token response, including a reported code 18036, concerns the token used to renew a session. It does not, by itself, prove that the separately saved DeviceAuth credential is permanently unusable. Deleting every credential because one refresh failed can remove information needed to recover the account safely.
Check whether the service is asking you to sign in again or reconnect the account. Follow that supported recovery path once. Keep the previous error time so support can distinguish a session problem from a later account-linking problem. Never try to repair a refresh failure by sharing a token or secret with another user.
Use the recovery flow without overlapping requests
Repeated sign-in attempts can leave several account-linking requests in flight. A late result from an earlier account must not be treated as authorization for the account currently selected in the panel. Check the account identity displayed after each completed recovery.
- Record the safe error name, numeric code when present, and the time zone.
- Complete any action shown by Epic through its official account interface.
- Return to the supported linking or recovery flow and finish one attempt.
- Verify the linked Epic account before starting the bot or changing another account's settings.
Reserve deletion for a verified decision
A generic login failure, an offline bot or a reconnecting status is not sufficient evidence for permanent credential removal. A provider's invalid-auth flag is also different from a live connection status. Support needs to establish what the provider confirmed and which saved credential that evidence applies to.
Send only the diagnostic details needed to classify the failure. Remove DeviceAuth secrets, access tokens, refresh tokens, cookies, email addresses and private links from screenshots or logs. If the account is recoverable, keeping its identity and authentication history intact allows a deliberate reconnection instead of an unnecessary rebuild.