api-debugging

Start by decoding the JWT to inspect its header and payload, then check the exp claim for expiration. Test the request with curl using the Authorization: Bearer header, review server logs for 401 entries, and verify signature, issuer, and audience validation.

Verify the redirect_uri matches exactly including trailing slashes, validate the token response contains access_token, refresh_token, and expires_in, and test the refresh flow before the access token expires. Also confirm the state parameter is validated for CSRF protection.

CORS errors occur when the server's allowed origins, credentials, or headers do not match the client's cross-origin request. Verify the Access-Control-Allow-Origin configuration and ensure required headers and methods are permitted on the server.

Check that webhook signatures are validated on receipt and that retry logic is implemented for failed deliveries. Review delivery logs on the provider side and confirm the receiving endpoint returns the expected acknowledgment status code.

Rate limiting returns 429 responses when request quotas are exceeded. Inspect X-RateLimit-* response headers to understand limits and remaining quota, then implement exponential backoff and request throttling in the client.