FAN_TURN_INVALID

The fan turn credential was refused

HTTP status 401 Unauthorized, code FAN_TURN_INVALID.

What it means#

The request carried a TL-Fan-Turn, but it did not verify: it was not signed by Live, was minted for another audience than backstage-api-fan or is not of type fan_turn, has expired, lives longer than 300 seconds, names a channel that is not active and customer-facing in its organisation, carries claims its verification level does not allow, claims an AI tier above the channel's configured Concierge AI tier, or embeds a customer token or order access tokens that do not verify for that channel and customer.

What to do#

Mint a fresh credential for the turn. From Live, check that it signs with the key it publishes at /.well-known/jwks.json, that the customer token it embeds is current and expires no earlier than the credential, and that the Worker clock is not far out.

On the wire#

Every error response carrying this code names this page in error.moreInfo, with the request id in the query string. See Error codes for the response shape and the list of every code.