# expired_token

The device code has expired, is unknown, or was already used (RFC 8628 §3.5).

## Meaning

Sent by `/token` to a polling device when its `device_code` has passed its lifetime
(900 seconds), is unknown, or was already redeemed.

## Impact

The device flow is over. The user has to start again on the device, which requests new
codes. Expected when the user did not finish in time.

## Diagnosis

The refusal is recorded under `oauth.token.issued` with reason `expired_token` and cause
`device_code_expired` or `device_code_unknown`. A redeemed code shows an earlier
`oauth.device.redeemed` record with the same `flow_id`.

## Mitigation

- As a client developer: stop polling and offer to start over with a new
  `/device_authorization` request. Do not poll again after a successful token response.
- As an operator: nothing to do.
- As a user: start the connection again on the device and enter the new code.

## Escalation

If fresh device codes expire at once, check Redis and the replicas' clocks, then open an
issue with the request id and the server version. Never attach the device code.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.