Skip to content

Invalid Session

URI: https://docs.ankatech.co/errors/invalid_session
HTTP Status: 400 Bad Request

The type suffix uses the underscore form of the OAuth 2.0 error code invalid_session it accompanies, so the two identifiers match.

When you see this

A step of the console sign-in (POST /api/v3/auth/authorize-challenge, submitAuthorizationChallenge) presented an auth_session the authorization server does not accept. Nothing was issued, and the sign-in has to start again with a new PKCE challenge.

Every answer of the sign-in hands out a new auth_session and stops accepting the one presented, and a sign-in lasts at most 10 minutes from its start.

Common Causes

  • The auth_session was already answered: a step was sent twice, or from two browser tabs.
  • The sign-in started more than 10 minutes ago.
  • The value is unknown, for example truncated.
  • A second code_challenge was sent with an auth_session: a transaction admits one.

Response Example

{
  "error": "invalid_session",
  "error_description": "The authentication session is unknown, has expired or was already used. Start again.",
  "error_uri": "https://docs.ankatech.co/errors/invalid_session",
  "type": "https://docs.ankatech.co/errors/invalid_session",
  "title": "Invalid Session",
  "status": 400,
  "detail": "The authentication session is unknown, has expired or was already used. Start again.",
  "instance": "/api/v3/auth/authorize-challenge",
  "timestamp": 1730000000
}

Content-Type: application/json — the RFC 6749 §5.2 error shape, as on the token endpoint, with the RFC 9457 members alongside. The Auth API carries no correlation member in the body: correlate through the X-Correlation-Id response header. See Error Index & Overview.

How to Resolve

  1. Start the sign-in again from its first request, with a new PKCE code_verifier and challenge.
  2. Send each step once, with the auth_session of the latest answer only.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.