# CoverPay errors

Errors are JSON: `{ "error": "human message", "code": "MACHINE_CODE" }`. Validation failures add `details`.

| HTTP | `code` | Meaning | What to do |
|---|---|---|---|
| 400 | `INVALID_LINK_TOKEN` | Link token missing or malformed. | Create a new one on your server. |
| 400 | `INVALID_PUBLIC_TOKEN` | `public_token` missing or does not start with `public-`. | Send the token Link returned. |
| 400 | (no code) `Invalid parameters` | Request body failed validation; see `details`. | Fix the fields listed. |
| 401 | `INVALID_LINK_TOKEN` | Link token not valid for this use. | Create a new one. |
| 401 | (no code) | Missing or invalid API key. | Send `x-api-key` with a key that matches the environment. |
| 404 | `INVALID_PUBLIC_TOKEN` | Not found, not yours, or the payment is not completed. | Do not retry; the same answer is given for other businesses' tokens. |
| 410 | `EXPIRED_LINK_TOKEN` | Link token expired (30 minutes for checkout). | Create a new one. |
| 410 | `USED_LINK_TOKEN` | Link token already used or finished. | Create a new one for a new attempt. |
| 410 | `EXPIRED_PUBLIC_TOKEN` | Public token older than 30 minutes. | Read the payment from your webhook or `GET /v1/bnpl/sessions/{payment_id}` instead. |

Link `onExit(error)` codes include `PAYMENT_FAILED` when the shopper's approval fails at the provider.