invalid_token

HTTP status: 401 · Code: invalid_token

The access token is malformed, signed by an unknown key, for another project, or its session has ended.

Why it happens

The access token is malformed, was signed by a key the project doesn’t know, belongs to another project, or its session has ended (signed out or revoked).

How to fix

Sign the user in again. The client SDKs clear the stored session for you. On your server, answer 401 and let the app sign in again; never accept the token. See Verify tokens on your server.

Catch it in your code

Every SDK throws one error type for a failed call. Match on its code, which is always invalid_token for this error, never on the message.

JavaScript and Next.js

import { ErrorCode, OrvanoError } from '@orvano/js'

try {
  // your Orvano call
} catch (error) {
  if (error instanceof OrvanoError && error.code === ErrorCode.invalidToken) {
    // handle invalid_token
  } else {
    throw error
  }
}

Dart and Flutter

import 'package:orvano_flutter/orvano_flutter.dart'; // or orvano_dart on a server

try {
  // your Orvano call
} on OrvanoException catch (error) {
  if (error.code != ErrorCode.invalidToken) rethrow;
  // handle invalid_token
}

.NET

using Orvano;

try
{
    // your Orvano call
}
catch (OrvanoException error) when (error.Code == ErrorCode.InvalidToken)
{
    // handle invalid_token
}

The error also carries the HTTP status (401), a message, and a request ID. Quote the request ID when you report a problem: the server logs it with the failure. See Errors for how errors work in every SDK, or every error code.