Question

A microservice authenticates successfully to a third-party payment API using OAuth 2.0 client credentials, but every call to the refund endpoint returns HTTP 403 Forbidden. Calls to the read-only balance endpoint from the same service succeed. The access token is valid and not expired. What is the MOST likely cause?

Accepted Answer

The access token was issued without the scope required to authorize the refund operation

Answer

The client secret used to obtain the token has been rotated and is now invalid

Answer

The service's system clock is skewed, causing token signature validation to fail

Answer

The API rate limit has been exceeded, throttling the refund requests