Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

expired_token

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The device code has expired, is unknown, or was already used (RFC 8628 §3.5).

Meaning

Sent by /token to a polling device when its device_code has passed its lifetime (900 seconds), is unknown, or was already redeemed.

Impact

The device flow is over. The user has to start again on the device, which requests new codes. Expected when the user did not finish in time.

Diagnosis

The refusal is recorded under oauth.token.issued with reason expired_token and cause device_code_expired or device_code_unknown. A redeemed code shows an earlier oauth.device.redeemed record with the same flow_id.

Mitigation

  • As a client developer: stop polling and offer to start over with a new /device_authorization request. Do not poll again after a successful token response.
  • As an operator: nothing to do.
  • As a user: start the connection again on the device and enter the new code.

Escalation

If fresh device codes expire at once, check Redis and the replicas' clocks, then open an issue with the request id and the server version. Never attach the device code.

OAuth error runbooks · Generated from internal/runbook/oauth.yaml in nauthera-server.