Errors

Errors come from three places, each with its own body.

Source	When	Body
Token endpoint	Requesting an access token	OAuth: error, error_description
API gateway	Before your request reaches an endpoint	error, message
Endpoint	Inside the API	The response envelope with error.code; problem details for a 500

Token request errors

HTTP	error	Fix
401	invalid_client	Check the assertion against the troubleshooting list.
400	invalid_request	Send every required form field, form-encoded.

Gateway errors

HTTP	error	Meaning	Fix
401	InvalidRequest	No Authorization header.	Send Authorization: Bearer <token>.
401	InvalidToken	The token is invalid, expired or not a partner token.	Request a new token.
403		The token lacks the scope the route needs. Empty body.	Request the scope. See Scopes.
429	RateLimitExceeded	Too many requests.	Wait for Retry-After. See Rate limits.
503	IdentityProviderUnavailable	The token could not be verified right now.	Retry after Retry-After, 5 seconds.

{ "error": "InvalidToken", "message": "Partner access token is invalid" }

Endpoint errors

Endpoints return the response envelope with a machine-readable error.code, and an RFC 7807 problem response with code for a 500. See Errors and Common errors. Each endpoint page lists the codes it can return.

Troubleshooting

invalid_client

• aud must be the token endpoint URL for the same environment, exactly.
• iss, sub and the client_id form field must all be your client ID.
• Sign with the private key that matches the registered certificate, using RS256.
• Use a new jti and a fresh iat for every request. Do not reuse an assertion.
• Check the server clock. A skewed clock makes a fresh assertion look expired.
• Check the API Credentials page. Tokens are only issued while the status is Active.

401 InvalidToken on a token that just worked

The token has expired. Tokens last 5 minutes. Cache the expiry from expires_in and renew 30 seconds early.

403 on a write

The token was issued without partner.write. Add it to the scope field of the token request.

Contacting support

Send your client ID, the time of the request in UTC, the full response body, and traceId if there is one. Never send your private key, an assertion or an access token.