Errors

Every error code we return, where, what causes it and how to fix it.

Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.

Errors follow OAuth 2.0: a JSON body { "error": "...", "error_description": "..." }, or, at the authorize step, error and error_description on the redirect back to you. Read error in code and show error_description only in your logs.

Some problems at the authorize step are shown on our page and never sent back: an unknown client, a redirect address you did not register, and a repeated parameter. We never send anybody to an address we have not checked.

access_denied

Cause: The person chose not now, or your app may not sign them in yet: a test app signs in only its team and named testers, a live app only after review, and nothing while it is suspended.

Fix: Show a way to try again. Read error_description to tell the cases apart, and add testers on the app's Testers page.

invalid_request

Cause: A parameter is missing or malformed: no PKCE, PKCE with plain, a bad max_age, prompt=none combined with another prompt, or a token request that is not form encoded.

Fix: Send every required parameter once, PKCE with S256, and form-encode the token request.

invalid_scope

Cause: A scope does not exist, or your client is not registered for it.

Fix: Add the scope on the app's Sign-in page. A sensitive scope on the live app needs a review first.

unsupported_response_type

Cause: response_type is not code.

Fix: Use the authorization code flow.

login_required

Cause: prompt=none was sent and nobody is signed in, or their sign-in is older than max_age.

Fix: Send them again without prompt=none.

consent_required

Cause: prompt=none was sent and the person has not agreed to these scopes yet.

Fix: Send them again without prompt=none.

interaction_required

Cause: prompt=none was sent and their account needs a step first, such as accepting new terms.

Fix: Send them again without prompt=none.

invalid_client

Cause: Your app could not be authenticated: a wrong or expired secret, a revoked or expired certificate, a bad client_assertion (aud must be the token endpoint, exp at most ten minutes ahead, jti new), a public app sending a secret, or the app is suspended.

Fix: Check the credential on the app's Credentials page and its expiry. Rotate without downtime: add a new one, deploy, then revoke the old.

invalid_grant

Cause: The code or refresh token cannot be used: the code expired (60 seconds) or was used, it was issued to another client, the redirect_uri or code_verifier does not match, a refresh token was used twice, access was withdrawn, or the tester was removed.

Fix: Start the sign-in again. Swap each code once, straight away, with the same redirect_uri and the verifier you kept.

unsupported_grant_type

Cause: grant_type is not authorization_code or refresh_token.

Fix: Use one of the two.

invalid_token

Cause: Not an access token (ID tokens are refused), expired (15 minutes), the account is suspended, access was withdrawn, or the app is suspended.

Fix: Refresh the access token, or sign the person in again. Never send an ID token to userinfo.

rate_limited

Cause: Over your quota for this bucket, this minute or this day.

Fix: Wait the Retry-After seconds. Requests over the limit still count, so a retry loop keeps you over it.

invalid_key

Cause: No API key was sent, or it is not one of ours, expired or revoked.

Fix: Send Authorization: Bearer with a key from the app's API keys page.

missing_right

Cause: The key does not carry the right this call needs.

Fix: Make a key with the right (app:read or usage:read).

not_found

Cause: The application this key belonged to has been removed.

Fix: Use a key of an app that still exists.

server_error

Cause: Something went wrong at our end.

Fix: Try again in a moment. If it keeps happening, check the status page and tell us in the chat.