Diagnosing credential problems.
WHAT THE COMMON CAUSES ARE
Wrong environment's credential Expired token Clock skew, where signatures include a timestamp Credential sent in the wrong header or format Missing scope Address restriction
WHY CLOCK SKEW MATTERS
Signed requests are rejected when the clock differs beyond a tolerance.
WHAT TO CHECK
That the machine's time is synchronised.
WHAT TO CHECK ABOUT THE HEADER
The exact name and prefix expected.
WHY
Providers differ, and the error is usually unhelpful.
WHAT TO VERIFY ABOUT A TOKEN
Whether it has expired Whether it was issued for this service Whether the scopes cover the call
WHAT A REFRESH FAILURE USUALLY MEANS
Permission was withdrawn, or the refresh token expired.
WHAT TO DO
Prompt reconnection, rather than retrying.
WHY
Retrying a revoked credential never succeeds.
WHAT TO CHECK ABOUT KEYS
Whether they were rotated Whether an address restriction applies Whether the account is suspended
WHAT TO TEST FIRST
The simplest authenticated call, from the command line.
WHY
It isolates credentials from everything else.
WHAT TO LOG
Authentication failures, separately.
WHAT TO ALERT ON
A sudden rise.
