password_reset_token_invalid

The password-reset link is not usable.

What to do

One code for four reasons — expired (they live 60 minutes), already used (single use), never existed, or the account's address changed after the mail went out. Which one is deliberately not published: distinguishing them is a probe oracle over a bearer credential, and the remedy is the same in all four. Ask for a new link with POST /account/password/reset_request.

The envelope

{
  "error": {
    "type": "invalid_request_error",
    "code": "password_reset_token_invalid",
    "message": "…",
    "hint": "One code for four reasons — expired (they live 60 minutes), already used (single use), never existed, or the account's address changed after the mail went out. Which one is deliberately not published: distinguishing them is a probe oracle over a bearer credential, and the remedy is the same in all four. Ask for a new link with `POST /account/password/reset_request`.",
    "retriable": false,
    "doc_url": "https://docs.facturia.cl/errors/password_reset_token_invalid",
    "request_id": "req_01K2R7Q9M4T2VB"
  }
}

Program against code, never against message — the prose can be rewritten, the code cannot (§5.8).

hint and retriable arrive in the response with these exact values: they are a function of code and come from the same dictionary GET /v1/error_codes serves, so the envelope and the dictionary cannot disagree. Both are English on the wire by design — one registry, one language. More in The error envelope.

See also

The machine-readable copy of this page lives at GET /v1/error_codes, unauthenticated.