498 Invalid Token

ArcGIS code for an expired or otherwise invalid authentication token.

Status

HTTP/1.1 498 Invalid Token

Details

Category: 4xx
Status: Unofficial (Esri ArcGIS). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry only after changing the request

Esri's ArcGIS Server returns 498 when a token is present but invalid or expired. It pairs with 499, which that platform uses when no token was supplied at all.

Both are specific to ArcGIS. Elsewhere in the industry, 499 has a completely different nginx meaning, which is a good reason to check the server software before interpreting either.

Common causes

An expired ArcGIS token.
A token issued for a different service or referrer than the one being called.

How to fix it

As the client

Request a new token and retry.
Check that the token's referrer or client id matches how you are calling the service.

As the server

Prefer 401 with WWW-Authenticate so standard clients can handle the condition.

Examples

GET /arcgis/rest/services/Map/MapServer?token=expired HTTP/1.1
Host: gis.example.com

HTTP/1.1 498 Invalid Token