Skip to main content
View as Markdown

Error Handling - Authentication

Error Handling​

  • Common KS-related error codes: INVALID_KS (malformed, expired, or revoked), MISSING_KS (no KS provided), SERVICE_FORBIDDEN (KS lacks permission), EXPIRED_KS (session past TTL), ACTION_BLOCKED (action limit reached).
  • On invalid/expired KS or insufficient privileges: re-issue with correct scope.
  • On 5xx / transient: use exponential backoff (e.g., 500ms, 1s, 2s, jitter), and cap retries. Monitor your request rate to stay within throttling limits.
  • Observability: log who asked for a session, requested TTL & privileges, and the call outcome (success/failure). Mask KS values in logs (show only last 6 chars) and store secrets exclusively in secret managers.

Retry strategy: For transient errors (HTTP 5xx, timeouts), retry with exponential backoff: 1s, 2s, 4s, with jitter, up to 3 retries. For client errors (4xx, INVALID_KS, insufficient privileges), fix the request parameters or re-issue the KS before retrying — these require corrective action to succeed.