# The access token is invalid

**URL:** <https://devforum.okta.com/t/the-access-token-is-invalid/8913>\
**Category:** Questions\
**Created:** [April 15, 2020, 5:16pm UTC](https://devforum.okta.com/t/the-access-token-is-invalid/8913 "2020-04-15T17:16:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![paulbutcher](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@paulbutcher](https://devforum.okta.com/u/paulbutcher)\
**Post date:** [April 15, 2020, 5:16pm UTC](https://devforum.okta.com/t/the-access-token-is-invalid/8913/1 "2020-04-15T17:16:26Z")

</div>

I’m very much a newbie when it comes to Okta, so I’m possibly missing something very basic. I’m trying to access the Okta API within a React application.

I’ve started from this sample:

> **[okta/samples-js-react](https://github.com/okta/samples-js-react/tree/master/okta-hosted-login)**
>
> React Auth SDK sample. Contribute to okta/samples-js-react development by creating an account on GitHub.

And have got it working as expected. I’ve then modified the Home page to call the Users API by adding the following code within the `useEffect`:

```
fetch("https://xlio.okta.com/api/v1/users/me", {
  headers: {
    Authorization: 'Bearer ' + authState.accessToken,
  }
}).then(value => console.log(value));

```

I’ve confirmed that the `okta.users.read.self` scope is granted for the application that I’ve created within the Okta admin UI.

The above code results in a `401` error, with the message “The access token is invalid.”

I suspect I’m missing something very basic, but am not sure what it might be. I would greatly appreciate a pointer in the right direction, or hints as to how to debug this.

Thanks!

---

<div class="post-metadata">

**Author:** ![dzeller](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dzeller/32/2790_2.png) [@dzeller](https://devforum.okta.com/u/dzeller)\
**Post date:** [April 15, 2020, 5:49pm UTC](https://devforum.okta.com/t/the-access-token-is-invalid/8913/2 "2020-04-15T17:49:10Z")

</div>

Hi, two things you should probably check are that:

1. You are requesting the okta.users.read.self scope in your authorize request and that the token itself contains this scope
2. The token was minted by the Org Authorization Server and not a Custom Authorization Server ([https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server](https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server)). The sample that you linked to is using a Custom Authorization Server.

---

<div class="post-metadata">

**Author:** ![paulbutcher](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@paulbutcher](https://devforum.okta.com/u/paulbutcher)\
**Post date:** [April 15, 2020, 6:09pm UTC](https://devforum.okta.com/t/the-access-token-is-invalid/8913/3 "2020-04-15T18:09:12Z")

</div>

Thanks @dzeller.

I _wasn’t_ requesting the okta.users.read.self self scope in the authorize request, but doing so doesn’t change the behaviour that I’m seeing ☹. How would I check “that the token itself contains this scope”?

I _believe_ that I’m using the Org Authorization Server. My org is called “xlio” and I’ve set ISSUER to [https://xlio.okta.com/oauth2/default](https://xlio.okta.com/oauth2/default) in the testenv file.

---

<div class="post-metadata">

**Author:** ![dzeller](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dzeller/32/2790_2.png) [@dzeller](https://devforum.okta.com/u/dzeller)\
**Post date:** [April 15, 2020, 9:42pm UTC](https://devforum.okta.com/t/the-access-token-is-invalid/8913/4 "2020-04-15T21:42:00Z")

</div>

@paulbutcher that would be the issuer of a Custom Auth Server (specifically the default one). The Org Authorization Server’s issuer would just be [https://xlio.okta.com](https://xlio.okta.com)  
See [https://developer.okta.com/docs/guides/implement-oauth-for-okta/overview/](https://developer.okta.com/docs/guides/implement-oauth-for-okta/overview/) for more information on using scoped tokens intended for Okta

---

<div class="post-metadata">

**Author:** ![paulbutcher](https://avatars.discourse-cdn.com/v4/letter/p/a5b964/32.png) [@paulbutcher](https://devforum.okta.com/u/paulbutcher)\
**Post date:** [April 16, 2020, 9:32am UTC](https://devforum.okta.com/t/the-access-token-is-invalid/8913/5 "2020-04-16T09:32:52Z")

</div>

Ah! I think the penny’s just dropped. Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 11:14pm UTC](https://devforum.okta.com/t/the-access-token-is-invalid/8913/6 "2024-01-23T23:14:26Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.