Errors

Every error code we return, where, what causes it and how to fix it.

Connectez-vous pour voir votre propre ID client de test dans les exemples.

Errors follow OAuth 2.0: a JSON body { "error": "...", "error_description": "..." }, or, at the authorize step, error and error_description on the redirect back to you. Read error in code and show error_description only in your logs.

Some problems at the authorize step are shown on our page and never sent back: an unknown client, a redirect address you did not register, and a repeated parameter. We never send anybody to an address we have not checked.

access_denied

Cause: The person chose not now, or your app may not sign them in yet: a test app signs in only its team and named testers, a live app only after review, and nothing while it is suspended.

Fix: Show a way to try again. Read error_description to tell the cases apart, and add testers on the app's Testers page.

invalid_request

Cause: A parameter is missing or malformed: no PKCE, PKCE with plain, a bad max_age, prompt=none combined with another prompt, or a token request that is not form encoded.

Fix: Send every required parameter once, PKCE with S256, and form-encode the token request.

invalid_scope

Cause: A scope does not exist, or your client is not registered for it.

Fix: Add the scope on the app's Sign-in page. A sensitive scope on the live app needs a review first.

unsupported_response_type

Cause: response_type is not code.

Fix: Use the authorization code flow.

login_required

Cause: prompt=none was sent and nobody is signed in, or their sign-in is older than max_age.

Fix: Send them again without prompt=none.

consent_required

Cause: prompt=none was sent and the person has not agreed to these scopes yet.

Fix: Send them again without prompt=none.

interaction_required

Cause: prompt=none was sent and their account needs a step first, such as accepting new terms.

Fix: Send them again without prompt=none.

invalid_client

Cause: Your app could not be authenticated: a wrong or expired secret, a revoked or expired certificate, a bad client_assertion (aud must be the token endpoint, exp at most ten minutes ahead, jti new), a public app sending a secret, or the app is suspended.

Fix: Check the credential on the app's Credentials page and its expiry. Rotate without downtime: add a new one, deploy, then revoke the old.

invalid_grant

Cause: The code or refresh token cannot be used: the code expired (60 seconds) or was used, it was issued to another client, the redirect_uri or code_verifier does not match, a refresh token was used twice, access was withdrawn, or the tester was removed.

Fix: Start the sign-in again. Swap each code once, straight away, with the same redirect_uri and the verifier you kept.

unsupported_grant_type

Cause: grant_type is not authorization_code or refresh_token.

Fix: Use one of the two.

invalid_token

Cause: Not an access token (ID tokens are refused), expired (15 minutes), the account is suspended, access was withdrawn, or the app is suspended.

Fix: Refresh the access token, or sign the person in again. Never send an ID token to userinfo.

rate_limited

Cause: Over your quota for this bucket, this minute or this day.

Fix: Wait the Retry-After seconds. Requests over the limit still count, so a retry loop keeps you over it.

invalid_key

Cause: No API key was sent, or it is not one of ours, expired or revoked.

Fix: Send Authorization: Bearer with a key from the app's API keys page.

missing_right

Cause: The key does not carry the right this call needs.

Fix: Make a key with the right (app:read or usage:read).

not_found

Cause: The application this key belonged to has been removed.

Fix: Use a key of an app that still exists.

server_error

Cause: Something went wrong at our end.

Fix: Try again in a moment. If it keeps happening, check the status page and tell us in the chat.