Errors

The API keeps the response shapes it has always had, so existing integrations keep working. OAuth adds a standard JSON shape of its own. Check the status code first, then the body.

OAuth errors

Returned when you authenticate with an access token.

Status	Body	Meaning
401	{"error":"invalid_token"}	The token is expired, malformed, signed by someone else, revoked, or used from an address the credential does not allow. Request a new one.
403	{"error":"insufficient_scope"}	The token is valid but lacks a scope the endpoint needs. The response names it.

The WWW-Authenticate header repeats the error, as OAuth clients expect.

Token endpoint errors

Status	error	Meaning
400	invalid_request	A required parameter is missing, or the location is not one the credential may act as.
400	unsupported_grant_type	Only client_credentials is supported.
400	invalid_scope	You asked for a scope the credential does not hold.
401	invalid_client	The client ID or secret is wrong, or the credential is revoked. These cases look identical on purpose.
429	temporarily_unavailable	Too many requests. Wait for the Retry-After period.
503	temporarily_unavailable	Tokens cannot be issued right now. Try again shortly.

API key errors

Requests made with an API key keep the legacy shapes:

Status	Body	Meaning
403	text: Access denied	The key is missing, wrong, or not allowed from your address.
403	text containing JSON: {"message":"..."}	The key is valid but the request is refused, for example a usage limit or a location you cannot access.
400	text containing JSON: {"message":"..."}	The request failed. The message says why.
400	{"IsSuccess":false,"Message":"..."}	The operation was refused. This is the common shape for validation failures.
404	{"Message":"No HTTP resource was found..."}	No such endpoint.

Some of these bodies are JSON sent with a text content type. Parse the body rather than relying on the Content-Type header.

See Limits for the quota and rate-limit responses.