Use this playbook to separate missing, expired, or invalid identity proof from authorization and transport failures, and apply credential-source-correct fixes safely.
Last reviewed: February 23, 2026|Editorial standard: source-backed operational guidance
Use 401 when authentication credentials are missing or invalid. Use 403 when authentication succeeded but policy denies access.
A refreshed token can still carry the wrong audience or issuer for the target API. A proxy can still mutate or strip auth headers before verification. The runtime can still resolve credentials from a different source than expected.
Retries keep failing when requests reuse invalid credentials or stale auth context. Fresh credentials, corrected audience-issuer alignment, and corrected credential source must change first. Blind retries only repeat the same identity-proof failure.
Clock drift causes `exp` and `nbf` checks to fail because token validity windows no longer align with verifier time. Stale JWKS cache causes signature verification failures after key rotation because the verifier still uses old keys for `kid` lookup. Check clock sync and NTP health first on failing nodes, then check JWKS cache refresh timing and key-rotation telemetry. These two faults together can keep failures active even after token refresh.