Token errors

Updated 2026-11-13

A call is refused because of its token: missing, wrong, expired or made for another service. This page lists each message, its cause and the fix.

What you see

The service is protected by tokens and the call did not carry a valid one. The API answers HTTP 400 with the reason in "error":

`"error"`	Cause	Fix
`Authentication required. Please provide a valid token using the 'token' parameter.`	No token arrived with the call.	Send the token: `?token=…` on GET, the header `Authorization: Bearer …` on POST.
`Invalid token`	The token is not known: mistyped, cut off, or revoked.	Copy the whole token again, or create a new one.
`Token expired`	The token had an expiry date and it has passed.	Create a new token and replace the old one in your code.
`Token does not belong to this service`	The token is valid, but for another service.	Use a token created in this service.

The discovery address and the MCP address answer the same problems with HTTP 401.

Fix it step by step

Check that a token is sent at all. On GET add &token=YOUR_TOKEN to the address. On POST send the header Authorization: Bearer YOUR_TOKEN.
Check the header. It is the word Bearer, one space, then the token. No quotes, no line break at the end.
Check that the token is complete. A token starts with svc_tk_. Copying from an e-mail or a chat can cut it or add a space.
Check that it is a token of this service. A token works for the one service it was created in. Compare the service id in your address with the service the token comes from.
Check the expiry. Open the service and go to API → Access (API → Zugriff). The list shows each token with its expiry; an expired one is marked Expired (Abgelaufen).
Create a new token if in doubt. A token is shown once, when it is created. If it was not stored, it cannot be shown again; create a new one and revoke the old one.

How to create, name and revoke tokens: Tokens and access.

The service used to work without a token

A service asks for a token once its owner has turned the token requirement on. Creating the first token of a service switches the requirement on in the editor, and the app says so: "Token authentication has been automatically enabled". Calls to a protected service without a token answer "Authentication required. …".

If the service should be protected: give every caller a token.
If the service should be public: see Tokens and access. Revoking the last token switches the requirement off in the editor ("Token authentication has been automatically disabled as no tokens remain").

Tokens in the browser, in Excel and in tools

Web pages: a token in front-end code is visible to every visitor. See Browser calls and CORS.
Excel and Google Sheets: the token is part of the address (?token=…). See Excel and Google Sheets as clients.
n8n, Zapier, Power Automate: see n8n, Zapier and Power Automate for where each tool takes the token.
AI assistants: an AI connected to your account reaches your services without a service token. For other people's AI see The MCP address of a service.

For developers and agents

API (`/api/v1/services/{id}/execute`)

Status: HTTP 400. Body: error (the reason), message (the same text), serviceId, inputs, details: null.
Where the token is read: the header Authorization: Bearer <token>, the query parameter token on GET, or the field "token" in a POST body.
The token check runs before anything is calculated or read from a cache. A protected service never answers a result without a valid token.
A refused call is listed in the service's Usage → Log with its reason. A call without a token appears under "Public (no token)"; a call with a token that is not valid appears under "Invalid token", and for 30 days after a revocation under the revoked token's name with "(revoked)".

Discovery address (`/d/{id}`)

Status: HTTP 401. Body of an action: {"success": false, "error": "…"}.
Without a token: This service requires authentication. Add ?token=YOUR_TOKEN to the URL.
Opening the address itself without a valid token answers 401 with the service name, the error and an instructions list; the description of the inputs is given once a valid token is sent.

Service MCP address

Status: HTTP 401 with a WWW-Authenticate: Bearer header and a JSON-RPC error. error.message is Authentication required or the reason (Invalid token, Token expired, Token does not belong to this service).
A client that supports it starts the sign-in flow on this answer; other clients send the service token as a Bearer token.

For an agent: a token error is not something to retry or to work around. Tell the user which message came back and ask for a valid token of this service.

FAQ

What does "Authentication required. Please provide a valid token using the 'token' parameter." mean?

The service is protected and your call carried no token. Add ?token=… to a GET address or send the header Authorization: Bearer … on POST.

What does "Invalid token" mean?

The token you sent is not known: it is mistyped, incomplete, or it was revoked. Copy the whole token again, or create a new one under API → Access.

What does "Token expired" mean?

The token had an expiry date and that date has passed. Create a new token under API → Access and replace the old one wherever it is used.

What does "Token does not belong to this service" mean?

The token is valid but was created in another service. Each token works for exactly one service; use one created in the service you are calling.

Why is the status 400 and not 401?

The API answers token problems with HTTP 400 and names the reason in "error". The discovery address and the MCP address answer the same problems with 401.

I lost my token. Can I see it again?

No. A token is shown once, when it is created. Create a new one, put it into your code, and revoke the old one.

Where do I put the token in a POST request?

In the header: Authorization: Bearer YOUR_TOKEN. On GET you can add it to the address as ?token=YOUR_TOKEN instead.

My calls worked yesterday and now ask for a token. Why?

The owner turned the token requirement on, so the service is now protected. Ask the owner for a token, or see Tokens and access if you own the service.

Can one token be used for several services?

No. A token belongs to the service it was created in, and another service answers "Token does not belong to this service". Create one token per service.

Does a revoked token stop working at once?

Yes. After revoking, calls with that token answer "Invalid token". Calls with other tokens of the service keep working.

How do I see which token made a call?

Open Usage → Overview (Nutzung → Übersicht) and look at Who is calling (Wer ruft auf): callers are listed by the name of their token. See The usage overview.