Troubleshooting

Common Errors

401 — "Invalid client credentials"

Cause: Client ID or secret is incorrect, or the OAuth client does not exist.

Fix:

  • Verify credentials are exactly correct (no trailing spaces or newlines)
  • Contact MT2Data to confirm your account is active

401 — "Token expired"

Cause: Access token has expired (lifetime is 1 hour).

Fix: Request a new token via POST /oauth/token. Implement token caching with expiry tracking in your application — see the Performance Guide.

403 — "Access denied" / "Symbol not found in your subscription"

Cause: You are trying to access a file that is not in your index.

Fix:

  • Use GET /catalog to see which Symbols you are authorized to access
  • Contact MT2Data if you need access to additional files

403 — "Invalid API key"

Cause: API key does not exist or has the wrong prefix.

Fix: Verify the key exists and is prefixed with mt2_admin_ or mt2_client_.

404 — File not found

Cause: The file exists in your catalog but has not yet been synced to R2, or the path/Symbol is incorrect.

Fix:

  • Use GET /catalog to verify the Symbol is in your subscription
  • Use GET /list to confirm the file actually exists in R2
  • Check that the Symbol spelling is exact (case-sensitive)

404 — "Catalog not found"

Cause: Your client does not have an index file configured in R2.

Fix: Contact MT2Data to ensure your index file has been uploaded.

400 — "unsupported_grant_type"

Cause: grant_type is missing or not set to client_credentials.

Fix:

  • Set grant_type=client_credentials in the request body
  • Ensure Content-Type is application/json or application/x-www-form-urlencoded

Changes not applying immediately

KV-stored credentials (new keys, updated index files) can take up to 60 seconds to propagate globally. Wait and retry.

Getting Help

If you encounter an issue not covered here, reach out through any of the following:

When contacting support, include:

  • Your Client ID (never the secret)
  • The exact error message and HTTP status code
  • The endpoint you were calling
  • Approximate timestamp of the request

Security Best Practices

  1. Never share your client secret — treat it like a password
  2. Use environment variables or a secrets manager — do not hardcode secrets in source code
  3. Cache tokens — request a new token only when the current one is near expiry, not on every call
  4. Use HTTPS only — all endpoints enforce HTTPS
  5. Rotate compromised secrets immediately — contact MT2Data if you suspect a secret has been exposed