Authentication: Expired JWT returns OAUTH_
Attention
This behavior change is in the 2026_07 bundle.
For the current status of the bundle, refer to Bundle history.
When this behavior change bundle is enabled, an expired key pair authentication JWT returns a more specific error code that distinguishes token expiry from other token validation failures.
- Before the change:
An expired key pair JWT returns error code 390303 with the message “Invalid OAuth access token,” the same error returned for any invalid OAuth token.
- After the change:
An expired key pair JWT returns error code 390318 with the message “OAuth access token expired.” Other invalid-token scenarios continue to return 390303.
If you have error-handling logic, monitoring, or alerting that matches on error code 390303 to detect expired tokens, update it to match on 390318 instead.
Ref: 2421