Skip to content

Token Expired

URI: https://docs.ankatech.co/errors/token-expired
HTTP Status: 410 Gone

When you see this

A validly-signed password-reset link was presented after its single-use token had expired. Emitted by ankasecure-auth-api on the password-reset endpoint. An activation link is not answered with this type: it starts the console's sign-in, which refuses a used, expired or invalid activation token with invalid_grant. The status is 410 rather than 404 because the link was genuine and is now permanently gone; the remedy is to request a new one.

Common Causes

  • The reset email sat unopened past the token's validity window.
  • The link was re-used long after it was issued.

Response Example

{
  "type": "https://docs.ankatech.co/errors/token-expired",
  "title": "Token Expired",
  "status": 410,
  "detail": "The activation or reset link has expired. Please request a new one.",
  "instance": "/api/v3/auth/account/password/reset",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail is a fixed sentence and discloses nothing about the account behind the link. This status is distinct from already-used (409) and from never-valid (400), so a client can tell the three apart.

How to Resolve

  1. Request a new password-reset email.
  2. Use the new link promptly — each one is single-use and time-bounded.
  3. If reset links keep expiring before they are opened, an operator can review the configured validity window for the deployment.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.