diff --git a/pkg/apigateway/clientman/authtoken.go b/pkg/apigateway/clientman/authtoken.go
index 128b968397..03ba2a9eab 100644
--- a/pkg/apigateway/clientman/authtoken.go
+++ b/pkg/apigateway/clientman/authtoken.go
@@ -275,7 +275,7 @@ func (t *SAuthToken) VerifyTotpPasscode(s *mcclient.ClientSession, uid, passcode
 	}
 
 	t.updateRetryCount()
-	return errors.Wrap(httperrors.ErrInvalidCredential, "invalid passcode")
+	return errors.Wrap(httperrors.ErrInputParameter, "invalid passcode")
 }
 
 func SignJWT(t jwt.Token) (string, error) {
diff --git a/pkg/apigateway/handler/auth_totp.go b/pkg/apigateway/handler/auth_totp.go
index 9c6abdc60a..a4463b3d0c 100644
--- a/pkg/apigateway/handler/auth_totp.go
+++ b/pkg/apigateway/handler/auth_totp.go
@@ -260,7 +260,7 @@ func validatePasscodeHandler(ctx context.Context, w http.ResponseWriter, req *ht
 
 	if err != nil {
 		log.Warningf("VerifyTotpPasscode %s", err.Error())
-		httperrors.InvalidCredentialError(ctx, w, "invalid passcode: %v", err)
+		httperrors.InputParameterError(ctx, w, "invalid passcode: %v", err)
 		return
 	}