Authentication Troubleshooting

This guide covers common authentication errors and their solutions. If you encounter an error not listed here, contact us via the API Support Help Center.

Common OAuth2 Errors

❌ Error: `invalid_grant`

Full error message:

{
  "error": "invalid_grant",
  "error_description": "User not validated"
}

Causes

User/Channel not activated - Your channel has not been validated by Onebox
Invalid channel_id - The channel_id provided does not exist
Channel not associated - Channel exists but is not properly configured

Solutions

Test Environment
Production Environment

If you're setting up for the first time:

Ensure you received credentials from Onebox technical team
Verify you're using the correct channel_id provided in your credentials
If you just received credentials, wait 5-10 minutes for system propagation

Still not working?

Your channel_id
Environment (test/production)
Full error response

If you passed certification but can't authenticate:

Verify you're using production credentials (not test credentials)
Check that you received production credentials after certification
Ensure production channel_id is different from test

Still not working?

This usually means production credentials were not properly activated. Contact us immediately via the API Support Help Center.

❌ Error: `Invalid JWT signature`

Full error message:

{
  "code": "AUTH001",
  "message": "Invalid JWT signature"
}

Causes

Wrong environment credentials - Using test credentials in production or vice versa
Expired token - Token has exceeded 12-hour validity period
Corrupted token - Token was modified or incorrectly stored

Solutions

1. Verify you're using the correct environment:

Quick Check
Wrong Configuration Example

# Test Environment
OAuth URL: https://api.oneboxtds.net/oauth/token
API URL: https://api.oneboxtds.net/*

# Production Environment
OAuth URL: https://api.oneboxtds.com/oauth/token
API URL: https://api.oneboxtds.com/*

Rule: OAuth URL and API URL must match domains (.net or .com)

❌ WRONG - Mixing environments:

// Getting token from TEST
const tokenUrl = 'https://api.oneboxtds.net/oauth/token';

// But calling PRODUCTION API
const apiUrl = 'https://api.oneboxtds.com/catalog-api/v1/events';

✅ CORRECT - Consistent environment:

// All test environment
const tokenUrl = 'https://api.oneboxtds.net/oauth/token';
const apiUrl = 'https://api.oneboxtds.net/catalog-api/v1/events';

2. Check token expiration:

Tokens expire after 12 hours. Implement token refresh logic:

let token = null;
let tokenExpiry = null;

async function getValidToken() {
  // Check if token exists and is not expired
  if (token && tokenExpiry > Date.now()) {
    return token;
  }

  // Request new token
  const response = await fetch('https://api.oneboxtds.net/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'client_credentials',
      channel_id: process.env.CHANNEL_ID,
      client_id: 'seller-channel-client',
      client_secret: process.env.CLIENT_SECRET
    })
  });

  const data = await response.json();
  token = data.access_token;
  // Set expiry with 5-minute buffer
  tokenExpiry = Date.now() + (data.expires_in - 300) * 1000;

  return token;
}

3. Verify token is not corrupted:

Do not manually modify the token string
Store token as-is from the OAuth response
Do not add/remove characters or whitespace
Check for proper URL encoding if passing in query parameters

❌ Error: `Full authentication is required to access this resource`

Full error message:

{
  "errorCode": "UNAUTHORIZED",
  "message": "Full authentication is required to access this resource",
  "httpCode": 401,
  "httpStatus": "UNAUTHORIZED"
}

Causes

Missing Authorization header - Token not sent with request
Wrong header format - Incorrect Bearer token format
Token not obtained - Attempting API call before getting OAuth token

Solutions

1. Verify Authorization header is present:

✅ CORRECT:

curl -X GET 'https://api.oneboxtds.net/catalog-api/v1/events' \
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...'

❌ WRONG - Missing Authorization:

curl -X GET 'https://api.oneboxtds.net/catalog-api/v1/events'

2. Check Bearer token format:

Correct Format
Common Mistakes

const headers = {
  'Authorization': `Bearer ${accessToken}`,
  'Content-Type': 'application/json'
};

Key points:

Starts with Bearer (with space after)
Followed by the access_token from OAuth response
No quotes around the token

❌ Missing "Bearer" prefix:

'Authorization': accessToken  // WRONG

❌ Missing space after Bearer:

'Authorization': `Bearer${accessToken}`  // WRONG

❌ Using wrong token field:

'Authorization': `Bearer ${refreshToken}`  // WRONG - use access_token

3. Ensure OAuth flow is completed first:

// Step 1: Get OAuth token (MUST be done first)
const tokenResponse = await fetch('https://api.oneboxtds.net/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    grant_type: 'client_credentials',
    channel_id: '123',
    client_id: 'seller-channel-client',
    client_secret: 'your-secret-here'
  })
});

const { access_token } = await tokenResponse.json();

// Step 2: Use token in API calls
const apiResponse = await fetch('https://api.oneboxtds.net/catalog-api/v1/events', {
  headers: {
    'Authorization': `Bearer ${access_token}`
  }
});

❌ Error: `invalid_client`

Full error message:

{
  "error": "invalid_client",
  "error_description": "Bad client credentials"
}

Causes

Wrong client_secret - The API key/client_secret is incorrect
Wrong client_id - Using incorrect client_id value
Credentials from wrong environment - Using test credentials in production

Solutions

1. Verify client_id:

For Seller Channel Clients, client_id should always be:

seller-channel-client

For Access Control Clients, check Access Control Authentication.

2. Verify client_secret (API Key):

Check for typos or copy-paste errors
Ensure no extra whitespace before/after the secret
Verify you're using the secret from the correct environment
Confirm the secret was not regenerated (ask technical support if unsure)

3. Double-check environment:

# Test credentials → Test URLs
https://api.oneboxtds.net

# Production credentials → Production URLs
https://api.oneboxtds.com

❌ Error: HTTP 403 Forbidden

Full error message:

{
  "errorCode": "FORBIDDEN",
  "message": "Access denied",
  "httpCode": 403,
  "httpStatus": "FORBIDDEN"
}

Causes

Insufficient permissions - Your channel does not have access to this resource
Event not associated - Trying to access an event not assigned to your channel
API endpoint not enabled - Your channel plan doesn't include this API

Solutions

1. Event not assigned to your channel:

If accessing a specific event and getting 403:

The event may not be published for your channel
The event may be assigned to different channels only
Contact the event promoter or API Support Help Center

2. API access not enabled:

Some APIs require specific permissions:

Verify your contract includes the API you're trying to use
Contact channels@oneboxtds.com to upgrade your plan

3. Production access before certification:

If getting 403 in production but test worked:

Ensure you completed certification successfully
Verify production credentials were provided
Check with the API Support Help Center

Testing Your Authentication

Quick Authentication Test

Use this curl command to test if your credentials work:

Test Environment
Production Environment

curl -X POST 'https://api.oneboxtds.net/oauth/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'channel_id=YOUR_CHANNEL_ID' \
  -d 'client_id=seller-channel-client' \
  -d 'client_secret=YOUR_CLIENT_SECRET'

Expected response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer",
  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 43199,
  "scope": "api-channels-all api-gateway",
  "jti": "..."
}

curl -X POST 'https://api.oneboxtds.com/oauth/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'channel_id=YOUR_CHANNEL_ID' \
  -d 'client_id=seller-channel-client' \
  -d 'client_secret=YOUR_CLIENT_SECRET'

Expected response: Same as test environment

Still Having Issues?

If you've tried the solutions above and still experiencing problems:

Before Contacting Support

Collect this information:

Environment: Test or Production
Channel ID: Your channel_id
Error details: Full error response (JSON)
Request details:
- URL called
- HTTP method
- Headers sent (DO NOT include client_secret)
Timestamp: When the error occurred

Contact Technical Support

🔗 Help Center: API Support Help Center

Open a ticket and include all information collected above.

Common OAuth2 Errors​

❌ Error: invalid_grant​

Causes​

Solutions​

❌ Error: Invalid JWT signature​

Causes​

Solutions​

❌ Error: Full authentication is required to access this resource​

Causes​

Solutions​

❌ Error: invalid_client​

Causes​

Solutions​

❌ Error: HTTP 403 Forbidden​

Causes​

Solutions​

Testing Your Authentication​

Quick Authentication Test​

Still Having Issues?​

Before Contacting Support​

Contact Technical Support​

Related Documentation​

Common OAuth2 Errors

❌ Error: `invalid_grant`

Causes

Solutions

❌ Error: `Invalid JWT signature`

Causes

Solutions

❌ Error: `Full authentication is required to access this resource`

Causes

Solutions

❌ Error: `invalid_client`

Causes

Solutions

❌ Error: HTTP 403 Forbidden

Causes

Solutions

Testing Your Authentication

Quick Authentication Test

Still Having Issues?

Before Contacting Support

Contact Technical Support

Related Documentation