Error codes

Every surface uses a closed set of error codes. Error responses never echo request input, tokens or claim values.

Authorization endpoint

Returned as query parameters on your redirect URI, with the original state:

?error=<code>&error_description=<text>&state=<state>

Code	Meaning
`access_denied`	The user denied consent or cancelled.
`login_required`	The user must authenticate.
`consent_required`	Consent is required and was not obtained.
`invalid_request`	Malformed request or missing required parameter.
`unauthorized_client`	The client may not use this flow.
`unsupported_response_type`	The response type is not supported.
`invalid_scope`	A requested scope is not allowed.
`server_error`	Internal failure.
`temporarily_unavailable`	Temporary outage.

JSON body with an HTTP status:

{ "error": "<code>", "error_description": "<text>" }

Code	Meaning
`invalid_request`	Missing or malformed parameter.
`invalid_client`	Client authentication failed.
`invalid_grant`	Code or refresh token invalid, expired, revoked, already used, or issued to another client.
`unauthorized_client`	The client may not use this grant.
`unsupported_grant_type`	The grant type is not supported.
`invalid_scope`	The requested scope is invalid.

JSON body { "error": "<code>" }.

Status	Code	Meaning
`401`	`invalid_token`	Missing, expired, revoked or otherwise invalid token.
`403`	`insufficient_scope`	The token does not carry the required scope (`openid`).
`502`	`temporarily_unavailable`	Upstream verification failed; retry is safe.

JSON body { "status": "error", "error": "<code>" }.

Code	Meaning
`invalid_request`	A field is malformed or missing.
`no_session`	The portal session is gone.
`forbidden`	The account does not own the object or lacks permission.
`not_found`	No such object for this account.
`quota_exceeded`	A quota is reached (tenants, production RPs, or local-dev RPs).
`conflict`	Version conflict or duplicate.
`unverified_host`	A production redirect host's domain is not proven.
`local_development_non_loopback`	Local development was selected with a non-loopback host.
`locked_invariant`	A locked protocol invariant was violated.
`not_allowed`	A scope, grant type or value is outside the allow-list.
`verification_failed`	The domain proof did not match.
`identity_break`	A redirect-host change was refused.
`step_up_required`	The session is not fresh enough.
`csrf_rejected`	A state-changing request failed the origin/CSRF checks.
`logo_too_large`	The logo exceeds the size limit.
`logo_type_unsupported`	The logo is not PNG, JPEG or WebP.
`terms_not_accepted`	The current operator terms were not accepted.
`export_not_ready`	No signed export head is available yet.
`upstream_error`	An upstream identity service call failed.
`internal_error`	Internal failure.

Surface / code	Retry?
`access_denied`, `invalid_grant`, `invalid_client`	No
`temporarily_unavailable`, `server_error`, `export_not_ready`	Yes, with backoff
`invalid_request`, `invalid_scope`, locked invariants	No — fix the request/configuration
Portal `conflict` / `step_up_required`	Reload/re-authenticate, then retry