Skip to content

Token Already Used

URI: https://docs.ankatech.co/errors/token-already-used
HTTP Status: 409 Conflict

When you see this

A validly-signed account activation or password-reset link was presented again after its single-use token had already been consumed. Emitted by ankasecure-auth-api on the activate and password-reset endpoints. The link was genuine — the request simply conflicts with the token's current single-use state.

Common Causes

  • The activation or reset was already completed with this link.
  • The account is already active, so the activation link has nothing left to do.
  • The link was opened twice, for example by a mail client that pre-fetches URLs.

Response Example

{
  "type": "https://docs.ankatech.co/errors/token-already-used",
  "title": "Token Already Used",
  "status": 409,
  "detail": "This activation or reset link has already been used.",
  "instance": "/api/v3/auth/account/activate",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail is a fixed sentence and carries no account state. This status is distinct from expired (410) and from never-valid (400), so a client can tell the three apart.

How to Resolve

  1. Try signing in: if this was an activation link, the account is most likely already active.
  2. If you need to set a new password, request a fresh reset email — each link is single-use.
  3. Do not re-open an old link; only the most recent one is usable.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.