Errors and limits
How the API reports problems, the rate limits, and a short security checklist.
Error format
The token, device code, user info and revoke endpoints answer errors as JSON, in the standard OAuth shape:
{ "error": "invalid_scope", "error_description": "Scope not permitted for this application." }Errors from the authorize endpoint arrive on your redirect_uri as error and error_description
query parameters.
error | Usually means |
|---|---|
invalid_request | A parameter is missing, malformed or too long |
invalid_client (401) | Unknown client_id, wrong secret, or the app is disabled |
invalid_grant | The code, device code or refresh token is wrong, expired, already used, or for another app; or the user can't sign in |
unauthorized_client | Your app type isn't allowed this grant (for example, the device flow from a web app) |
unsupported_grant_type | Unknown grant_type |
invalid_scope | Unknown scope, or one not registered for your app |
access_denied | The user said no |
login_required, consent_required | Only with prompt=none: the user would have to see a screen |
Rate limits
Going over a limit returns 429 Too Many Requests. Back off and try again later.
| Endpoint | Limit |
|---|---|
| Token and revoke | 120 requests per 5 minutes per IP address, and 300 per 5 minutes per client |
| Device code | 30 requests per 5 minutes per IP address |
| Device polling | 150 polls per 5 minutes per device code (respect interval and you'll never get close) |
Browsers (CORS)
The token, device code, user info, revoke and discovery endpoints accept requests from any origin, so single-page apps can call them directly. The authorize endpoint is a page the user visits, not an API.
Security checklist
- Use PKCE on every sign-in, and check
stateandisson the way back. - Register exact redirect URIs, over https (http only for localhost).
- Keep client secrets and refresh tokens on a server or in the platform's secure storage, never in web pages or logs.
- Key your users by
sub, not by username or email. - Verify ID tokens fully (signature,
iss,aud,exp,nonce) before trusting them. - Revoke the refresh token when the user signs out of your app.