Skip to content

Invalid Token

URI: https://docs.ankatech.co/errors/invalid-token
HTTP Status: 400 Bad Request

When you see this

An account activation or password-reset link was rejected as invalid. Emitted by ankasecure-auth-api on the activate and password-reset endpoints. This type is deliberately distinct from the generic invalid-input, so a client can render a "this link is not usable" message rather than a form-validation one.

Common Causes

  • The token is malformed, or was never valid.
  • The token is not yet valid.
  • The token refers to a user that does not exist, to a deleted account, or to a tenant that does not match — three account-existence-sensitive reasons that are collapsed into this same answer.

Response Example

{
  "type": "https://docs.ankatech.co/errors/invalid-token",
  "title": "Invalid Token",
  "status": 400,
  "detail": "The activation or reset link is invalid.",
  "instance": "/api/v3/auth/account/activate",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

Every cause above produces this byte-identical body. That is deliberate and it is a security property: the endpoint is reachable by anyone holding a link, so a body that distinguished "no such user" from "malformed token" would be a user- and tenant-enumeration oracle. The internal reason is logged and never rendered — the response will not tell you which of the causes applied.

How to Resolve

  1. Use the most recent link from the invitation or reset email, unmodified — a truncated or re-wrapped URL is the common cause.
  2. If the link is intact and still refused, request a new activation or reset email and use that link instead.
  3. If it keeps failing, an operator can read the server log for this request: the internal reason is recorded there.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.