Skip to main content
Every Public API bearer error uses the error envelope documented on the contracts page: an error object with code (HTTP status), key (machine-readable key), message (human-readable text), optional details, and a meta.requestId. Match client logic on the exact error.key string, never on error.message. Messages may be reworded or translated; keys are stable. error.key values come in two families:
  • Framework keys are dotted lowercase (auth.invalid_token, rate_limit.exceeded). They are emitted by the shared Public API plumbing: authentication, scopes, rate limiting, idempotency, routing, and server errors. They can occur on any bearer endpoint.
  • Endpoint validation keys are UPPER_SNAKE (PUBLIC_API_INVALID_CLIENT_ID, CLIENT_NOT_FOUND). They are emitted by endpoint request validation and domain checks, so each key only occurs on the endpoints that use the underlying resource.

Framework keys

Endpoint validation keys

Endpoint validation keys use UPPER_SNAKE. The tables below list every key the Public API can emit. PUBLIC_API_* keys are Public API specific; the domain keys in the second table are shared with internal validation logic but are just as stable.

PUBLIC_API_* keys

Domain keys

OAuth token endpoint errors

POST /public/v1/oauth/token does not use the bearer error envelope. It returns standard OAuth 2.0 (RFC 6749) error responses: See the authentication page for the token request and response shape.