OAuth Token Refresh Failures (`POST https://api.nuki.io/oauth/token`)

Nuki APIs Web
1

Hello,

I need assistance troubleshooting why OAuth token refresh requests have been regularly failing via:

POST https://api.nuki.io/oauth/token

Case 1

From 2025-08-11T18:13:15.339Z UTC to 2025-08-11T18:21:43.965Z UTC, I attempted to refresh an OAuth token 5 times.

All of the requests failed with status code 504:


{

"response": "<html>\r\n<head><title>504 Gateway Time-out</title></head>\r\n<body>\r\n<center><h1>504 Gateway Time-out</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"

}

Case 2

After re-authenticating the same account as above, I observed new errors between 2025-08-21T04:52:49.020Z UTC and 2025-08-21T04:57:52.142Z UTC across 6 attempts:

  • 4 requests failed with 500 Internal Server Error:

{

"code": 500,

"description": "The server encountered an unexpected condition which prevented it from fulfilling the request"

}
  • 2 requests failed with 429 Too Many Requests:

{

"error": "refresh_token_rate_exceeded",

"error_description": "The token refresh operation rate exceeded"

}

I have another account that experienced the same issues (500 + 429) around 2025-08-21, and a similar situation occurred about 2–3 months ago.

All requests were made with a delay of about 1–3 minutes between each attempt.

Could you please investigate and advise how I can mitigate these recurring cases?

Thank you,
Andrii

2

Hi Andrii,

Case 1 appears to be a side-effect of an outage that we had on 11th August where the API was unreachable. Sorry about that; feel free to subscribe to updates on the status page so you can be actively informed when such issues occur.

Regarding case 2, firstly the 429 responses are due to hitting a rate limit. As of writing, we have rate limits defined of 4 requests per second, 100 per minute and 1000 per hour.

The 500 responses occurred during a short-time frame, so I believe this is also related to a short performance degradation or outage. It may have been under the threshold to trigger an alert and therefore an entry on the status page.

I think your retry handling with a 1-3 minute delay is the best way of mitigating these issues at the moment.

Kind regards,

Andrew