E0000011 Invalid token provided on new Integrator Free Plan org

Newly created Integrator Free Plan org. API tokens return 401 E0000011 “Invalid token provided” immediately after creation. Reproducible with plain curl, so not an SDK issue.

  • Admin console works normally
  • Token shows as Active
  • Created under a Super Admin account
  • Regenerating the token does not help

This looks like the same issue reported in /t/invalid-token-provided-with-api-token-calls/34651 where Okta staff applied a per-tenant fix.

Org URL: https://integrator-7107085.okta.com

Could the fix be applied here as well? Thanks.

@andrea

Hi,

By any chance, do you have any Network Zones configured that could be causing the request to be rejected? If that’s the case, try removing the Network Zone and check if that solves the issue related to the 401.

Thanks @vk-giri , checked Security → Networks and there’s nothing custom configured.
BlockedIpZone is empty and DefaultEnhancedDynamicZone is inactive.

No network conditions on the token itself either.

This is a fresh Integrator Free Plan org created a few days ago, nothing customised. Token shows Active, created under a Super Admin, and the 401 E0000011 reproduces with plain curl.
Regenerating doesn’t help.

Org URL: https://integrator-7107085.okta.com

Looks like the same issue where a per-tenant fix was applied earlier in this thread , could that be applied here?

This is not the same issue as discussed in previous threads, so the same fix does not apply.

How are you currently authorizing these API calls? Are you using a static API token or an OAuth bearer token? Can you share an example curl request so we can ensure its configured correctly?

The most recent 401 error I can find for your org in our logs was back on the 8th and it looks like OAuth bearer token was being sent but we did not receive a valid/complete JWT/JWE. Since those logs were from a couple of days ago, can you also confirm if you are still experiencing this issue?

I will also note that at least one of the failing requests I found does mention the request coming from outside the allowed network zones, as @vk-giri mentioned