# server_error

UserInfo could not check the access token; keep the token and retry (500).

## Meaning

The token check could not be completed: the grant behind it, the DPoP replay store
or the nonce store did not answer. It is sent with no `WWW-Authenticate` challenge,
because nothing is wrong with the client's credential (RFC 6749 §5.2, RFC 6750
§3.1).

## Impact

The relying party gets no claims while the store is failing. It points at a database
or cache outage, not at the client.

## Diagnosis

1. Search the logs for the request id.
2. The refusal is recorded as `oauth.token.presented` with reason `internal_error`,
   or `unavailable` with a `stage` naming the store that did not answer.
3. Check readiness (`GET /readyz` on `:9090`) and the cache.

## Mitigation

- As a client developer: keep the token and retry with backoff; do not discard it.
- As an operator: restore the database or cache.

## Escalation

Escalate when it persists with healthy stores. Open an issue with request ids, the
log lines for them and the server version. Never attach the token.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.