# Troubleshoot authentication (https://developer.godaddy.com/en/docs/api-users/troubleshoot/authentication) *** title: Troubleshoot authentication description: Common authentication errors when calling GoDaddy APIs, with causes and resolutions. agentNotes: scopes: \["Any — this page covers cross-cutting auth issues"] rateLimit: "N/A (diagnostic reference)" failureRecovery: "Diagnostic page. On 401, check token format and expiration. On 403, distinguish scope vs eligibility via the code field." faqItems: * question: "Why do I get 401 Unauthorized from the GoDaddy API?" answer: "The Authorization header is missing, malformed, or the token has expired or been revoked. Verify the format is 'Authorization: Bearer ', check the token hasn't expired, and confirm it hasn't been revoked on the Personal Access Token page." * question: "Why do I get 403 Forbidden despite having a valid token?" answer: "The token doesn't include the scope required for the operation. Generate a new token with the required scopes. The domains.domain:read scope is required even for write operations that need to verify state." * question: "Why do I get 403 ACCOUNT\_NOT\_ELIGIBLE?" answer: "The account doesn't meet eligibility requirements — typically a missing payment profile or domain ownership requirement. Add a payment method or verify you hold at least one domain." * question: "Why do I get 422 NO\_PAYMENT\_PROFILE on purchase calls?" answer: "The operation requires a funded billing method (registration, renewal, transfer) but no payment method is on file. Add a payment method to your account." * question: "Why did my token stop working after previously working?" answer: "The token has expired (PATs have configurable expiration) or was revoked. Check the expiration date, generate a new token if needed, and update your secrets manager." * question: "Why do I get 'invalid\_client' when requesting an OAuth token?" answer: "For Platform Applications, go to Troubleshoot Authentication under Build Apps Set Up. The client\_id or client\_secret is usually wrong, missing, or sent in the wrong format." * question: "Why do I get 'invalid\_grant' when exchanging an authorization code?" answer: "For Platform Applications, go to Troubleshoot Authentication under Build Apps Set Up. Authorization codes are single-use and expire quickly — exchange immediately and match redirect\_uri exactly." * question: "Why do I get 'invalid\_scope' on a token request?" answer: "For Platform Applications, go to Troubleshoot Authentication under Build Apps Set Up. Check scope format and that every scope is listed in godaddy.toml authorization\_scopes." related: guides: * title: "Authenticate" href: "/docs/api-users/auth" * title: "Troubleshoot Authentication (Platform Apps)" href: "/docs/guides/applications/set-up/troubleshoot-authentication" * title: "Set up a payment profile" href: "/docs/api-users/payment-profile" * title: "Troubleshoot your first call" href: "/docs/api-users/troubleshoot/first-call" concepts: * title: "Error handling" href: "/docs/api-users/errors" *** ## Overview This page covers the most common authentication and authorization errors you'll encounter when calling GoDaddy APIs. Each section describes the symptom, cause, and resolution. ## 401 Unauthorized **Symptom:** API returns `401` with `code: "UNAUTHORIZED"`. **Cause:** The `Authorization` header is missing, malformed, or the token has expired or been revoked. **Resolution:** * Verify the header format is `Authorization: Bearer ` (no extra whitespace or quotes around the token value). * Check the token hasn't expired — PATs have a configurable expiration. Generate a new one if needed. * Confirm the token hasn't been revoked on the [Personal Access Token](https://developer.godaddy.com/personal-access-token) page. * If using `sso-key`, verify the format is `sso-key :` with no extra spaces. ## 403 Forbidden — missing scope **Symptom:** API returns `403` with a code indicating insufficient permissions, despite a valid token. **Cause:** The token is valid but doesn't include the scope required for the operation. **Resolution:** * Check the `code` field in the error response — it distinguishes between scope and eligibility issues. * Generate a new token with the required scopes. Go to [Authentication — PAT scopes](https://developer.godaddy.com/docs/api-users/auth#pat-scopes) for the full list. * The `domains.domain:read` scope is required even for write operations that need to verify state. ## 403 Forbidden — account eligibility **Symptom:** API returns `403` with a code like `ACCOUNT_NOT_ELIGIBLE` despite having the correct scope. **Cause:** The account doesn't meet the eligibility requirements for the operation — typically a missing payment profile or domain ownership requirement. **Resolution:** * For billing-related eligibility: add a payment method. Go to [Set up a payment profile](https://developer.godaddy.com/docs/api-users/payment-profile). * For domain management eligibility: the account must hold at least one domain or be on a plan that grants management access. * Check the `code` field — don't rely on HTTP status alone to distinguish scope from eligibility issues. ## 422 with `NO_PAYMENT_PROFILE` **Symptom:** API returns `422` with `code: "NO_PAYMENT_PROFILE"` on quote or purchase calls. **Cause:** The operation requires a funded billing method (registration, renewal, transfer) but the account has no payment method on file. **Resolution:** Add a payment method. Go to [Set up a payment profile](https://developer.godaddy.com/docs/api-users/payment-profile). ## Token stops working after working previously **Symptom:** A token that was working returns `401` without any code changes. **Cause:** The token expired (PATs have a configurable expiration) or was revoked. **Resolution:** * Check the token's expiration date on the [Personal Access Token](https://developer.godaddy.com/personal-access-token) page. * If expired or revoked, generate a new token. * Update your secrets manager or environment variable with the new value. ## OAuth token request errors (Platform Applications) Building a **Platform Application** and seeing `invalid_client`, `invalid_grant`, or `invalid_scope` from `POST /v2/oauth2/token`? Those OAuth token errors are documented under Build Apps: **Go to [Troubleshoot Authentication](https://developer.godaddy.com/docs/guides/applications/set-up/troubleshoot-authentication).** This Use APIs page stays focused on PAT, Domains eligibility, and API `401` / `403` / `422` responses above.