Errors describe different failures
04The server distinguishes malformed requests, invalid tokens, and insufficient privileges.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.1 ↗
RFC 6750 · § 3.1EXAMPLE
3 / 3
03
Client response
Refresh or request appropriate authorization as applicable; do not treat every failure as the same error.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
invalid_request describes a malformed authentication request.
- invalid_request describes a malformed authentication request.
- invalid_token can describe expiry, revocation, or other invalidity and normally uses 401.
- insufficient_scope normally uses 403 and can identify the required scope.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy