# INVALID_TOKEN

> 401: the key or token is missing, expired or revoked.

The request carried no bearer token, or one the API does not accept.

## Why it happens

- No `Authorization: Bearer …` header.
- The personal key was revoked, has expired, or was mistyped (keys carry a checksum).
- The OAuth access token expired (they last one hour) or was issued for another resource.
- The member disconnected your app, or is not yet in the group the API is open to.
- An app session token from the Refract app itself: the API never accepts those.

## How to fix it

Refresh the access token with your refresh token, or send the member through
[Sign in with Refract](/developers/authentication#sign-in-with-refract) again. For a personal key, create a new one in
the app. The `WWW-Authenticate` header of the answer names the scope the endpoint needs.