RaaS/Integration OAuth2 Token Request Returns 401 Even With Correct Credentials
The error HTTPError: 401 Client Error: Unauthorized for url: https://wd5-impl-services1.workday.com/ccx/oauth2/dropbox/token.
What it means
A 401 on the OAuth2 token endpoint isn't always a bad client ID or secret. Workday locks out an Integration System User (ISU) after too many failed sign-in attempts, and a locked ISU returns the same generic 401 Unauthorized as a credentials problem, so regenerating the client secret or refreshing the token won't fix it.
Troubleshooting
- Run the "Signons and Attempted Signons" report with "Show Signon Attempts with an Invalid User Name" checked to see whether the ISU is reaching Workday at all and what's actually being logged against it.
- Look for a lockout status or a run of failed attempts immediately before the integration started failing - that's the signal it's a lockout, not a credentials or config issue.
- Confirm the client ID, secret, and refresh token configured on the calling system (e.g. a Splunk Add-on or other RaaS consumer) haven't drifted independently of the lockout.
- Have a Workday security admin unlock or reset the ISU account rather than continuing to regenerate tokens, which does nothing for a lockout.
⚡ Quick fix
Have a Workday security admin unlock the ISU account, then retry the OAuth2 token request unchanged.
✓ Permanent fix
Alert on repeated failed sign-in attempts for integration ISUs (via the Signons report or a scheduled audit) so a bad deploy or a stale stored credential doesn't silently lock the account and masquerade as a token or configuration bug during troubleshooting.
Was this helpful?