Skip to content

Token Already Used

URI: https://docs.ankatech.co/errors/token-already-used
HTTP Status: 409 Conflict

When you see this

A validly-signed password-reset link was presented again after its single-use token had already been consumed. Emitted by ankasecure-auth-api on the password-reset endpoint. An activation link is not answered with this type: it starts the console's sign-in, which refuses a used, expired or invalid activation token with invalid_grant. The link was genuine — the request simply conflicts with the token's current single-use state.

Common Causes

  • The reset was already completed with this link.
  • The link was opened twice, for example by a mail client that pre-fetches URLs.

Response Example

{
  "type": "https://docs.ankatech.co/errors/token-already-used",
  "title": "Token Already Used",
  "status": 409,
  "detail": "This activation or reset link has already been used.",
  "instance": "/api/v3/auth/account/password/reset",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail is a fixed sentence and carries no account state. This status is distinct from expired (410) and from never-valid (400), so a client can tell the three apart.

How to Resolve

  1. Try signing in with the password you set: the reset most likely already succeeded.
  2. If you need to set a new password, request a fresh reset email — each link is single-use.
  3. Do not re-open an old link; only the most recent one is usable.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.