Error map
invalid algorithm JWT error: invalid algorithm / The specified alg value is not allowed / jwt signature is required
Authentication · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
Cloudflare Error 1005: Access denied — The owner of this website has banned the autonomous system number (ASN) your IP address is in
The site owner blocked your network provider (ASN) — common for VPNs, cloud/data-center IPs and some mobile carriers.
invalid_token: The access token is invalid (JsonWebTokenError: invalid signature / jwt malformed)
A token was sent but the server couldn’t verify it — bad signature, malformed, revoked, or issued for another audience or environ…
Cloudflare Error 1006 / 1007 / 1008: Access denied — Your IP address has been banned
The site owner (or a Cloudflare security setting) blocked your IP address.
Cloudflare Error 1010: The owner of this website has banned your access based on your browser's signature
Cloudflare’s bot detection blocked the request because its browser fingerprint looks automated.
Error: secretOrPrivateKey must have a value (jsonwebtoken sign)
jwt.sign() got an empty secret — the environment variable holding the JWT secret isn’t loaded.
Cloudflare "Just a moment..." / "Checking your browser" challenge loop (Verify you are human never finishes)
The Cloudflare challenge keeps reloading — the browser can’t pass it because cookies/JavaScript are blocked, the clock is wrong,…
API/app requests get 403 with cf-mitigated: challenge (Bot Fight Mode / challenge on non-browser clients)
Cloudflare is answering API calls, webhooks or mobile-app requests with a challenge page (HTML 403) because bot protection treats…
JWT Expired / Invalid Token
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rejects it (usually wit…
AADSTS50053: Your account is locked (Smart Lockout) / sign-in blocked due to suspicious activity
Too many failed sign-ins (or sign-ins from a malicious IP) triggered Entra Smart Lockout.
Cloudflare Error 1009: Access denied — The owner of this website has banned the country or region your IP address is in
The site blocks visitors from your country/region.
Cloudflare Error 1011: Access denied (Hotlinking denied)
An image or file is being loaded from another site, and Cloudflare Hotlink Protection blocked it.
Cloudflare Error 1012: Access denied
The site owner blocked access with a rule that matched your request (often due to malicious activity detected from your IP).
Two steps away (34)
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
driver failed programming external connectivity on endpoint: iptables: No chain/target/match by that name
Docker’s iptables rules were wiped (firewalld/ufw reload, iptables flush) while Docker was running, so it can’t publish ports.
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
Error creating: pods is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...
The namespace enforces a Pod Security Standard (baseline/restricted) and the pod spec breaks one of its rules.
ssh: connect to host x port 22: Connection timed out
SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! (ssh host key changed)
The server’s SSH host key differs from the one saved in ~/.ssh/known_hosts — usually because the server was rebuilt or the IP was…
HTTP 418 I'm a teapot
An April Fools’ status from RFC 2324 — some sites and WAFs return it on purpose to tell bots or scrapers to go away.
Nginx 444 No Response (connection closed without response)
An Nginx-specific code: the server deliberately closed the connection without sending anything — a rule is dropping the request.
Cloudflare Error 1015: You are being rate limited
The site’s Cloudflare rate-limiting rule blocked you for sending too many requests in a short time.
HTTP 413 Content Too Large (Request Entity Too Large)
The request body is bigger than the server is willing to accept — usually a file upload over the configured limit.
Kubernetes: CreateContainerConfigError — secret / configmap not found
Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…
hint: You have divergent branches and need to specify how to reconcile them.
Git 2.27+ asks you to choose merge, rebase or fast-forward-only when local and remote both have new commits.
Cloudflare Turnstile error 110200 / 300030 / 600010 (widget fails to load or verify)
The Turnstile widget couldn’t run or validate — wrong sitekey/domain, blocked scripts, or a client/network issue.
java.lang.SecurityException: Permission Denial ... requires android.permission.X
The app called an API that needs a permission it hasn’t declared or the user hasn’t granted at runtime.
ASP.NET Core: The antiforgery token could not be decrypted / The required antiforgery cookie is not present (400 Bad Request)
Form POST failed antiforgery validation — the token is missing, the cookie is missing, or Data Protection keys changed so old tok…
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
SyntaxError: Unexpected token < in JSON at position 0
`JSON.parse()` / `response.json()` received something that isn’t JSON — very often an HTML error page.
WordPress: 403 Forbidden on wp-admin, wp-login.php or admin-ajax.php
The server or a security layer refused access to WordPress admin URLs — file permissions, a security plugin/WAF rule, ModSecurity…
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
API Error: Invalid API Key / Incorrect API key provided
The API didn’t recognise the key sent with the request — it’s wrong, revoked, from another environment, or sent in the wrong plac…
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY
apt can’t verify a repository’s signature because the repo’s signing key isn’t installed (or has expired/rotated).
SELinux is preventing ... / avc: denied { read } for pid=... (permission denied despite correct permissions)
SELinux blocked the access — file permissions look fine, but the file’s security context or a boolean doesn’t allow the service t…
AADSTS50126: Error validating credentials due to invalid username or password
Microsoft Entra ID (Azure AD) rejected the sign-in because the username or password is wrong — or the flow can’t use passwords fo…
HTTP 451 Unavailable For Legal Reasons
The content is blocked for legal reasons — a court order, government censorship, sanctions, or GDPR geo-blocking.
ForbiddenError: invalid csrf token (EBADCSRFTOKEN)
The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie.
macOS: “App” is damaged and can’t be opened. You should move it to the Trash.
Gatekeeper blocked an app that isn’t properly signed/notarized or was modified after download (quarantine attribute).
Kubernetes: ImagePullBackOff / ErrImagePull
The node can’t pull the container image — wrong name/tag, missing registry credentials, or registry unreachable.
exec /usr/local/bin/docker-entrypoint.sh: exec format error
The container tried to run a binary built for a different CPU architecture (arm64 vs amd64) — or a script with a broken shebang /…
Fatal error: Uncaught Error: Call to undefined function imagecreatefromjpeg()
The GD extension (or its JPEG/WebP support) isn’t installed for the PHP version serving the site.
Azure SQL: Cannot open server 'x' requested by the login. Client with IP address 'y' is not allowed to access the server (Error 40615)
The Azure SQL server firewall doesn’t allow your client’s IP address.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException