Skip to content

498 Invalid Token

ArcGIS code for an expired or otherwise invalid authentication token.

Status

HTTP/1.1 498 Invalid Token

Details

  • Category: 4xx
  • Status: Unofficial (Esri ArcGIS). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

Esri's ArcGIS Server returns 498 when a token is present but invalid or expired. It pairs with 499, which that platform uses when no token was supplied at all.

Both are specific to ArcGIS. Elsewhere in the industry, 499 has a completely different nginx meaning, which is a good reason to check the server software before interpreting either.

Common causes

  • An expired ArcGIS token.
  • A token issued for a different service or referrer than the one being called.

How to fix it

As the client

  • Request a new token and retry.
  • Check that the token's referrer or client id matches how you are calling the service.

As the server

  • Prefer 401 with WWW-Authenticate so standard clients can handle the condition.

Examples

An expired ArcGIS token

HTTP request

GET /arcgis/rest/services/Map/MapServer?token=expired HTTP/1.1
Host: gis.example.com

HTTP response

HTTP/1.1 498 Invalid Token

See also