Error responses

Token endpoint

Situation	HTTP status	Response
Invalid client ID or secret	401	{"error":"invalid_client"}
Credentials sent in the body instead of the Basic auth header	401	{"error":"invalid_client"}
Unsupported or missing grant_type	400	{"error":"invalid_request"} or {"error":"unsupported_grant_type"}
Requested a scope you are not authorised for	400	{"error":"invalid_scope"}
Requested an audience you are not authorised for	400	{"error":"invalid_request"}

API requests

Responses carry a code field to help identify the cause.

Situation	HTTP	code	Likely cause and fix
No token supplied	401	—	Missing Authorization header
Token expired	401	—	Request a new token
Token signature invalid	401	—	Token was not issued by this environment — check you are using staging credentials against staging, and production against production
Audience missing or incorrect	401	401.AUD	The audience parameter was omitted from your token request, or set to the wrong value. See Requesting an access token — this is the most common integration issue
Token issuer not recognised	401	401.ISS	Token was obtained from the wrong environment's token endpoint
Insufficient scope	403	403.SCOPE	Your token does not carry the scope required for this endpoint. Check the scopes you requested, and that your account is authorised for them
Endpoint not available to your token	403	403.TOKEN	This endpoint is restricted and not available to partner integrations

Getting 401.AUD?

If you receive 401.AUD, your credentials are not the problem. Check that your token request includes the correct audience value for your environment (https://stgxcis.mobixone.co.za staging / https://xcis.mobixone.co.za production).