Skip to content

Token Expired

URI: https://docs.ankatech.co/errors/token-expired
HTTP Status: 410 Gone

When you see this

A validly-signed account activation or password-reset link was presented after its single-use token had expired. Emitted by ankasecure-auth-api on the activate and password-reset endpoints. The status is 410 rather than 404 because the link was genuine and is now permanently gone; the remedy is to request a new one.

Common Causes

  • The invitation or reset email sat unopened past the token's validity window.
  • The link was re-used long after it was issued.

Response Example

{
  "type": "https://docs.ankatech.co/errors/token-expired",
  "title": "Token Expired",
  "status": 410,
  "detail": "The activation or reset link has expired. Please request a new one.",
  "instance": "/api/v3/auth/account/activate",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail is a fixed sentence and discloses nothing about the account behind the link. This status is distinct from already-used (409) and from never-valid (400), so a client can tell the three apart.

How to Resolve

  1. Request a new activation or password-reset email.
  2. Use the new link promptly — each one is single-use and time-bounded.
  3. If activation links keep expiring before they are opened, an operator can review the configured validity window for the deployment.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.