Invalid Token Format

What it means

The Authorization header was present, but the token isn't shaped like a real API token.

This usually points at your integration's setup rather than anything the end user did. Show the end user a generic message like "Something went wrong on our end.", and log detail for your own debugging.

How to fix it

1. 1.

   The token is missing its ib_ or ibw_ prefix, or the underscore-separated secret.

   Copy the token again from Settings → API Tokens. It should look like ib_{clientId}_{secret}.

2. 2.

   The header isn't exactly Bearer <token>, because of extra spaces or wrong casing on Bearer.

   Send the header as Authorization: Bearer ib_... with a single space after Bearer.

Where this happens

Enforced by shared authentication middleware before any endpoint-specific code runs. Every /api/v0/ request made with a Bearer token can return this.