# OAuth error runbooks

> One runbook per error of an OAuth 2.0, OpenID Connect or dynamic client registration error response. The response's error_uri links to its page here.

One runbook per `error` of an OAuth 2.0, OpenID Connect or dynamic client registration error response. The response's `error_uri` links to its page here.

| Error | What it means |
|---|---|
| [`invalid_request`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_request) | The request lacks a parameter, combines parameters wrongly or breaks a rule checked before any grant is evaluated (RFC 6749 §4.1.2.1, §5.2). |
| [`invalid_client`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_client) | Client authentication failed at an endpoint that authenticates the client (RFC 6749 §5.2). |
| [`invalid_grant`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_grant) | The authorization code, refresh token or device code is invalid, expired, already used, revoked, or not this client's (RFC 6749 §5.2). |
| [`unauthorized_client`](https://www.nauthera.io/docs/v1/runbooks/oauth/unauthorized_client) | The client is not permitted the grant it asked for (RFC 6749 §4.1.2.1, §5.2). |
| [`unsupported_grant_type`](https://www.nauthera.io/docs/v1/runbooks/oauth/unsupported_grant_type) | The token request named a grant type this server does not implement (RFC 6749 §5.2). |
| [`unsupported_response_type`](https://www.nauthera.io/docs/v1/runbooks/oauth/unsupported_response_type) | The authorization request asked for a response type this server does not serve (RFC 6749 §4.1.2.1). |
| [`invalid_scope`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_scope) | The requested scope is not registered for the client, or asks for more than the grant holds (RFC 6749 §4.1.2.1, §5.2). |
| [`temporarily_unavailable`](https://www.nauthera.io/docs/v1/runbooks/oauth/temporarily_unavailable) | The server could not establish what it needed to answer, and the request may succeed if retried (RFC 6749 §4.1.2.1). |
| [`server_error`](https://www.nauthera.io/docs/v1/runbooks/oauth/server_error) | The server hit an unexpected condition and could not complete the request (RFC 6749 §4.1.2.1). |
| [`invalid_token`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_token) | The access token presented is missing, invalid, expired, revoked or not usable here (RFC 6750 §3.1). |
| [`login_required`](https://www.nauthera.io/docs/v1/runbooks/oauth/login_required) | The request forbade interaction and the user has no session that satisfies it (OpenID Connect Core 1.0 §3.1.2.6). |
| [`consent_required`](https://www.nauthera.io/docs/v1/runbooks/oauth/consent_required) | The request forbade interaction and the user has not consented to it (OpenID Connect Core 1.0 §3.1.2.6). |
| [`interaction_required`](https://www.nauthera.io/docs/v1/runbooks/oauth/interaction_required) | The request forbade interaction and the server needs some (OpenID Connect Core 1.0 §3.1.2.6). |
| [`account_selection_required`](https://www.nauthera.io/docs/v1/runbooks/oauth/account_selection_required) | The request asked the user to choose an account, which this server cannot offer (OpenID Connect Core 1.0 §3.1.2.6). |
| [`request_not_supported`](https://www.nauthera.io/docs/v1/runbooks/oauth/request_not_supported) | The server does not support the request parameter (OpenID Connect Core 1.0 §3.1.2.6). |
| [`request_uri_not_supported`](https://www.nauthera.io/docs/v1/runbooks/oauth/request_uri_not_supported) | The server does not support the request_uri parameter (OpenID Connect Core 1.0 §3.1.2.6). |
| [`invalid_request_uri`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_request_uri) | The request_uri is unknown, expired, already used, pushed by another client, or not a fetchable registered URL (RFC 9126 §2.2, RFC 9101 §5.2, §6.2). |
| [`invalid_request_object`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_request_object) | The signed request object is malformed, unverifiable or invalid (RFC 9101 §6.3). |
| [`invalid_authorization_details`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_authorization_details) | The authorization_details parameter is malformed or names a type the client may not request (RFC 9396 §5). |
| [`authorization_pending`](https://www.nauthera.io/docs/v1/runbooks/oauth/authorization_pending) | The user has not yet approved or denied the device authorization (RFC 8628 §3.5). |
| [`slow_down`](https://www.nauthera.io/docs/v1/runbooks/oauth/slow_down) | The device polled faster than its interval allows (RFC 8628 §3.5). |
| [`expired_token`](https://www.nauthera.io/docs/v1/runbooks/oauth/expired_token) | The device code has expired, is unknown, or was already used (RFC 8628 §3.5). |
| [`access_denied`](https://www.nauthera.io/docs/v1/runbooks/oauth/access_denied) | The user or the server refused the request (RFC 6749 §4.1.2.1, RFC 8628 §3.5). |
| [`invalid_target`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_target) | The resource indicator is malformed or was not part of the grant (RFC 8707 §2). |
| [`unsupported_token_type`](https://www.nauthera.io/docs/v1/runbooks/oauth/unsupported_token_type) | The server does not support revoking or introspecting this type of token (RFC 7009 §2.2.1). |
| [`invalid_dpop_proof`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_dpop_proof) | The DPoP proof is missing or fails a validation check (RFC 9449 §4.3, §7.1). |
| [`use_dpop_nonce`](https://www.nauthera.io/docs/v1/runbooks/oauth/use_dpop_nonce) | The DPoP proof must carry a nonce from this server; retry with the one supplied (RFC 9449 §8, §9). |
| [`invalid_redirect_uri`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_redirect_uri) | One or more redirect URIs in a dynamic registration are invalid (RFC 7591 §3.2.2). |
| [`invalid_client_metadata`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_client_metadata) | A client metadata value in a dynamic registration is invalid or not permitted (RFC 7591 §3.2.2). |
| [`invalid_software_statement`](https://www.nauthera.io/docs/v1/runbooks/oauth/invalid_software_statement) | The software statement presented is invalid (RFC 7591 §3.2.2). |
| [`unapproved_software_statement`](https://www.nauthera.io/docs/v1/runbooks/oauth/unapproved_software_statement) | The software statement presented is not approved for use by this server (RFC 7591 §3.2.2). |