Invalid token

What it means

The bearer credential is missing, unknown, expired or revoked, or was not issued for this API.

Common causes

• No bearer credential was sent.
• The API key was revoked, has expired or was copied wrong.
• The OAuth access token has expired, or its audience is not https://api.tobie.team.

What to do

Do not retry with the same credential. Refresh the OAuth access token or use a current API key. The WWW-Authenticate header points to the sign-in metadata.

Retry: only after a fix. The same request fails the same way until you change the request, the credential or the resource.

This response also carries WWW-Authenticate, which says how to authenticate and where the sign-in metadata lives.

Over MCP, the same failure is a tool result with isError: true, the code invalid_token and retryable: false.

Example

A response body for this problem. The detail and instance vary with the request.

{
  "type": "https://api.tobie.team/problems/invalid_token",
  "title": "Invalid token",
  "status": 401,
  "detail": "Invalid credential",
  "code": "invalid_token",
  "instance": "/v1/tasks",
  "requestId": "01JC0S7Z5F3X9QK2M4N6P8R0TV"
}