Errors
401 - token revoked or expired
What happened
The credential is no longer accepted because it expired or was revoked. The same credential will keep failing.
- Identify the rejected tokenCheck which credential the application is loading.
- Obtain a valid credentialUse the approved account or credential flow.
- Reload the application secretUpdate the secret store rather than hard-coding the token.
- Verify accessRepeat the request with the new credential.
Request that triggers it
A bearer token whose exp claim is in the past, or whose ID has been added to the revocation set.
curl -X POST "https://$OC_HOST/v1/tenants/$OC_TENANT/sql" \
-H "Authorization: Bearer eyJ...expired..." \
-H "Content-Type: application/json" \
-d '{"sql": "SELECT id FROM shop.products LIMIT 1"}'Read the response
{
"error": "unauthorized",
"message": "token expired at 2026-04-30T12:00:00Z",
"retry": false
}Fix the request
- Obtain a valid credential through the approved account flow.
- Update the application’s secret store.
- Reload the connection configuration.
- Retry with the new credential.
Keep in mind: Do not log the token while debugging. Automatic refresh is not a guarantee of every SDK or credential type.
Common causes
- Token issued with a short TTL for an integration test that ran later than expected.
- System clock drift between the client and the engine - if the client clock is far ahead, valid tokens look expired.
- Team member rotated the token in the dashboard but didn't redeploy the consumer.
- Token explicitly revoked after an offboarding.
Continue
See error handling and retries, or return to error examples.