Reference
Errors
Handle authentication, authorization, validation, rate-limit, and server errors predictably.
Use the HTTP status
Treat 401 as missing or invalid authentication, 403 as insufficient access, 404 as an unavailable or hidden resource, 429 as a rate limit, and 5xx as a temporary service failure.
Do not expose sensitive context
Log request identifiers and safe error codes. Do not log tokens, authorization codes, full document contents, or sensitive request bodies.
Next
Rate limits