Reference

Errors

Error codes from the OAuth endpoints, the Management API, the hosted pages and the SDK, and what to do about each.

View .md llms.txt

#Authorization endpoint

Returned to your redirect_uri as ?error=…&error_description=…&state=… (or in the fragment for the implicit flow).

`error`	Cause	Fix
`invalid_request`	A missing or malformed parameter (PKCE missing for a public client, unsupported `code_challenge_method`, …)	Read `error_description`
`unauthorized_client`	The application may not use this flow (e.g. implicit not turned on)	Use authorization code + PKCE, or enable the grant
`unsupported_response_type`	`response_type` isn't `code` (or an implicit type the app allows)
`invalid_scope`	A scope the tenant doesn't know	Define it on the API
`invalid_target`	`audience` isn't one of your APIs	Check the API identifier
`access_denied`	The user declined consent, or cancelled	Let them try again
`login_required`	`prompt=none` and no session	Start a normal sign-in
`consent_required`	`prompt=none` and consent is needed	Start a normal sign-in
`request_not_supported`	`request` or `request_uri` was sent	Send plain parameters

An unknown client_id or a redirect_uri that isn't registered never redirects: the user sees an error page, because sending them to an unverified URL would be unsafe.

#Token endpoint

JSON { "error": "…", "error_description": "…" }, status 400 unless noted.

`error`	Cause
`invalid_request`	Missing parameter
`invalid_client` (401)	Unknown client, wrong secret, or no authentication for a confidential client
`invalid_grant`	The code is wrong, used or expired; the PKCE verifier doesn't match; the `redirect_uri` differs; the refresh token is expired, revoked or reused; the session ended; a wrong password (password grant), or two-factor is needed
`unauthorized_client`	The grant isn't enabled for this application
`unsupported_grant_type`	Unknown `grant_type`
`invalid_scope`	More scopes than allowed (client credentials) or than originally granted (refresh)
`invalid_target`	Unknown audience
`access_denied`	Client credentials for an API the application hasn't been given access to
`authorization_pending`, `slow_down`, `expired_token`	Device flow: keep polling, poll slower, start over

#Management API

JSON { "error", "error_description"?, "details"? }. See the Management API reference.

#Hosted pages

What users see is translated; the codes (in the activity log and some redirects) are:

Code	Message (English)
`invalid_credentials`	Login failed
`account_blocked`	Account has been blocked
`too_many_attempts`	Too many attempts. Please try again later.
`transaction_expired`	This sign-in request has expired. Please start again from the application.
`method_disabled`	This sign-in method is not available.
`registration_disabled`	Registration is not available.
`signups_paused`	New accounts can't be created for this application right now. (Free plan above its user limit)
`quota_exceeded`	Sign-in is temporarily unavailable for this application.
`upstream_error`	Sign-in is temporarily unavailable. (Your adapter or an identity provider failed)
`social_failed`	Signing in with {provider} did not complete.
`sms_unavailable`	We can't send a text message to this number. (Country not allowed, or SMS not available on the plan)
`link_invalid`	This sign-in link is invalid, has expired or was already used.
`invalid_code`, `code_expired`	The one-time code is wrong, or expired

Every text can be changed per language under Translations.

#SDK

NineError codes are listed in the SDK reference.