OAuth error runbooks
Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program
One runbook per error of an OAuth 2.0, OpenID Connect or dynamic client registration error response. The response's error_uri links to its page here.
| Error | What it means |
|---|---|
invalid_request | The request lacks a parameter, combines parameters wrongly or breaks a rule checked before any grant is evaluated (RFC 6749 §4.1.2.1, §5.2). |
invalid_client | Client authentication failed at an endpoint that authenticates the client (RFC 6749 §5.2). |
invalid_grant | The authorization code, refresh token or device code is invalid, expired, already used, revoked, or not this client's (RFC 6749 §5.2). |
unauthorized_client | The client is not permitted the grant it asked for (RFC 6749 §4.1.2.1, §5.2). |
unsupported_grant_type | The token request named a grant type this server does not implement (RFC 6749 §5.2). |
unsupported_ | The authorization request asked for a response type this server does not serve (RFC 6749 §4.1.2.1). |
invalid_scope | The requested scope is not registered for the client, or asks for more than the grant holds (RFC 6749 §4.1.2.1, §5.2). |
temporarily_unavailable | The server could not establish what it needed to answer, and the request may succeed if retried (RFC 6749 §4.1.2.1). |
server_error | The server hit an unexpected condition and could not complete the request (RFC 6749 §4.1.2.1). |
invalid_token | The access token presented is missing, invalid, expired, revoked or not usable here (RFC 6750 §3.1). |
login_required | The request forbade interaction and the user has no session that satisfies it (OpenID Connect Core 1.0 §3.1.2.6). |
consent_required | The request forbade interaction and the user has not consented to it (OpenID Connect Core 1.0 §3.1.2.6). |
interaction_required | The request forbade interaction and the server needs some (OpenID Connect Core 1.0 §3.1.2.6). |
account_ | The request asked the user to choose an account, which this server cannot offer (OpenID Connect Core 1.0 §3.1.2.6). |
request_not_supported | The server does not support the request parameter (OpenID Connect Core 1.0 §3.1.2.6). |
request_ | The server does not support the request_uri parameter (OpenID Connect Core 1.0 §3.1.2.6). |
invalid_request_uri | The request_uri is unknown, expired, already used, pushed by another client, or not a fetchable registered URL (RFC 9126 §2.2, RFC 9101 §5.2, §6.2). |
invalid_request_object | The signed request object is malformed, unverifiable or invalid (RFC 9101 §6.3). |
invalid_ | The authorization_details parameter is malformed or names a type the client may not request (RFC 9396 §5). |
authorization_pending | The user has not yet approved or denied the device authorization (RFC 8628 §3.5). |
slow_down | The device polled faster than its interval allows (RFC 8628 §3.5). |
expired_token | The device code has expired, is unknown, or was already used (RFC 8628 §3.5). |
access_denied | The user or the server refused the request (RFC 6749 §4.1.2.1, RFC 8628 §3.5). |
invalid_target | The resource indicator is malformed or was not part of the grant (RFC 8707 §2). |
unsupported_token_type | The server does not support revoking or introspecting this type of token (RFC 7009 §2.2.1). |
invalid_dpop_proof | The DPoP proof is missing or fails a validation check (RFC 9449 §4.3, §7.1). |
use_dpop_nonce | The DPoP proof must carry a nonce from this server; retry with the one supplied (RFC 9449 §8, §9). |
invalid_redirect_uri | One or more redirect URIs in a dynamic registration are invalid (RFC 7591 §3.2.2). |
invalid_client_metadata | A client metadata value in a dynamic registration is invalid or not permitted (RFC 7591 §3.2.2). |
invalid_ | The software statement presented is invalid (RFC 7591 §3.2.2). |
unapproved_ | The software statement presented is not approved for use by this server (RFC 7591 §3.2.2). |