BMM CONNECT DOCUMENTATION

Errors and responses

Handle denied access, expired attempts and temporary failures.

Hosted errors

Errors use {"error":"message"}. Invalid fields or changed/unregistered callbacks return 400; invalid credentials return 401; unapproved apps or missing earnings consent return 403; absent/revoked connections return 404; revoked pending approval returns 410; rate limiting returns 429. Disabled applications are unavailable (400 or 401 depending on credential validation). Treat 5xx/network failures as temporary and retry reads with backoff. Do not cache private responses. API key rotation leaves active hosted connections intact but requires the new key and restarting any unfinished SDK handshake.

Errors and recovery

BMM wrapper/resource errors have this shape:

json

{ "error": "This creator has not shared their settled earnings." }

Provider OAuth errors can instead use an OAuth code plus description, for example:

json

{ "error": "invalid_grant", "error_description": "The authorization grant is invalid." }

Descriptions are diagnostic and may change; use status and OAuth error code rather than matching text. Invalid grants do not all have the same HTTP status.

Status	Meaning / action
400	Invalid callback, unavailable application, expired/invalid authorization or grant. Check configuration or restart Connect.
401	Wrong/rotated API key, expired access, or revoked connection. Refresh before known expiry; otherwise check credentials and reconnect. Do not loop.
403 on support	Earnings not shared. Hide earnings and counts.
404	Connection missing, revoked or resource unavailable. Check the application and environment.
410 at checkout	Source revoked or does not belong to the creator. Offer the ordinary profile URL.
413	Request too large. Correct the request.
429	Back off; current limits use minute windows. Avoid refresh/reconnect loops.
500 / 503 / network error	Temporary failure or server configuration problem. Retry reads with backoff. Treat code/refresh exchanges as potentially consumed if the outcome is uncertain.

Read responses must not be publicly cached. Keep credentials out of URLs, browser storage and logs. Authorization callbacks necessarily contain a short-lived code; redact callback query strings in access logs. Never log token endpoint responses.

← All endpoints