Error Codes

Standard HTTP status codes and their meanings.

Common statuses

Status	Meaning	Typical cause
400	Bad Request	Missing or malformed parameter
401	Unauthorized	Missing/expired token or invalid signature
403	Forbidden	Insufficient permission, IDOR block
404	Not Found	Resource does not exist
409	Conflict	Duplicate (e.g. order_id reused)
422	Unprocessable Entity	Validation failure
429	Too Many Requests	Rate limit exceeded — see `Retry-After: 60` header
500	Internal Server Error	Server-side failure (retry advised)

`error` code	Meaning
`invalid_grant`	Code expired/reused or `redirect_uri` mismatch
`invalid_client`	Incorrect `client_id` or `client_secret`
`unsupported_grant_type`	`grant_type` value is not supported
`pkce_required`	`code_challenge` is missing
`pkce_verifier_mismatch`	`code_verifier` does not match the original challenge

Sample response:

{
  "error": "invalid_grant",
  "error_description": "Authorization code is expired or already used"
}

HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json
 
{"detail": "Rate limit exceeded"}