Issue with API authentication flow — please read the docs first

I posted this question three times on StackOverflow and got zero answers, so I guess that's where everyone is hiding their incompetence these days. The error says 'invalid token,' which means you sent a bad one. Simple enough,

Understood. I'll check again.

The entire issue is explained in section 4.2 of the auth guide and documented as a known limitation in the v1 endpoint. The fix involves migrating to the new oauth flow which has been stable for months. I can't keep answering this — search the forum, it was already posted

I've answered this three times in this thread and I will answer it a fourth: you are passing client_secret as a query parameter, which is explicitly deprecated since v2.4 because of log leakage risks. The docs have been updated — look at the auth flow section on

The OAuth2 token endpoint in this SDK is actually non-standard — it expects the client_id as a query parameter rather than in the POST body, which is what usually trips up implementations that follow standard RFC 6749 behavior.

A few specifics to check:

• Ensure you're passing the client secret via Basic Auth header (Authorization: Basic <base64(id:secret))>) rather than as a form field.
• The token endpoint doesn't support grant_type=client_credentials in its current version — it requires refresh_token. If that was your plan, you have to use the client credentials flow endpoint at /v1/oauth2/cc instead.
• Token caching is handled by the SDK automatically if you pass a cache backend to the constructor; otherwise every request will hit the refresh loop and look like throttling on your end.