Rate Limiting on PostToken call

I've noticed an inconsistency with the response that PostToken returns when in a rate-limited situation.

When making calls to other endpoints, if rate-limited, I get a 429 status code with a "Retry-After" header that tells me how long I need to wait before trying again.

With PostToken, though, it's returning a status code of 400 and the header isn't there. Instead, the response content is something like "{"error":"invalid_request","description":"rate limit exceeded; retry after: 4","error_description":"rate limit exceeded; retry after: 4"}".

I'm able to parse the JSON to get the "retry after" value, but this is less ideal because it relies on the error description never changing, or my parsing logic will break.

Is there a reason the error response for this particular call is different from others? Why would this not also return a 429 and have the retry-after header?

This is working as expected per the OAuth 2.0 spec. RFC 6749 - The OAuth 2.0 Authorization Framework section 5.2 requires that error responses use the status code 400 with a particular response body.

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.