SubtitleEdit/subtitleedit · error · Exception

Could not get access token via {tokenEndpoint}: {result}

Error message

Could not get access token via {tokenEndpoint}: {result}

What it means

Thrown by MicrosoftTranslator.GetAccessToken when the POST to the Azure token endpoint (issueToken) returns a non-success status. The endpoint URL and the response body are included. This is the root cause wrapped by error 52 ('Can't get Access Token'). It is logged via SeLogger before throwing.

Source

Thrown at src/libuilogic/AutoTranslate/MicrosoftTranslator.cs:157

            }

            return _httpClient;
        }

        private static string GetAccessToken(string apiKey, string tokenEndpoint)
        {
            return Task.Run(async () =>
            {
                using (var httpClient = DownloaderFactory.MakeHttpClient())
                {
                    httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                    httpClient.DefaultRequestHeaders.TryAddWithoutValidation(SecurityHeaderName, apiKey);
                    var response = await httpClient.PostAsync(tokenEndpoint, new StringContent(string.Empty)).ConfigureAwait(false);
                    var result = await response.Content.ReadAsStringAsync().ConfigureAwait(false);
                    if (!response.IsSuccessStatusCode)
                    {
                        SeLogger.Error($"{StaticName}: Error getting access token via {tokenEndpoint}: status code={response.StatusCode} {result}");
                        throw new Exception($"Could not get access token via {tokenEndpoint}: {result}");
                    }

                    return result;
                }
            }).GetAwaiter().GetResult();
        }

        private static List<TranslationPair> GetTranslationPairs()
        {
            if (_translationPairs != null)
            {
                return _translationPairs;
            }

            return Task.Run(async () =>
            {
                using (var httpClient = DownloaderFactory.MakeHttpClient())
                {

View on GitHub (pinned to 17a9f07487)

Solutions

  1. Copy the exact token endpoint from the Azure resource's 'Keys and Endpoint' / 'Resource Management' blade.
  2. Ensure the key matches that resource's region (regional endpoints reject global keys and vice versa).
  3. Regenerate the key in Azure and update MicrosoftTranslatorApiKey.
  4. Test the endpoint with curl using the same header to see Azure's raw error.

Example fix

// before
throw new Exception($"Could not get access token via {tokenEndpoint}: {result}");

// after - branch on the common 401/403 to give an actionable hint
var hint = response.StatusCode == HttpStatusCode.Unauthorized
    ? " (Azure rejected the API key - check MicrosoftTranslatorApiKey)"
    : response.StatusCode == HttpStatusCode.Forbidden
        ? " (Key region may not match this endpoint)"
        : string.Empty;
throw new Exception($"Could not get access token via {tokenEndpoint}: {result}{hint}");
Defensive patterns

Strategy: validation

Validate before calling

// Validate the token endpoint shape before the POST
var endpoint = Configuration.Settings.Tools.MicrosoftTranslatorTokenEndpoint;
if (string.IsNullOrWhiteSpace(endpoint))
    throw new InvalidOperationException("Microsoft Translator token endpoint is not set.");
if (!Uri.TryCreate(endpoint, UriKind.Absolute, out var uri) || uri.Scheme != Uri.UriSchemeHttps)
    throw new InvalidOperationException($"Token endpoint must be an absolute HTTPS URL: {endpoint}");
if (!endpoint.Contains("issueToken", StringComparison.OrdinalIgnoreCase))
    throw new InvalidOperationException($"Token endpoint should be an issueToken URL: {endpoint}");

Type guard

public static bool IsValidAzureTokenEndpoint(string endpoint)
    => Uri.TryCreate(endpoint, UriKind.Absolute, out var u)
    && u.Scheme == Uri.UriSchemeHttps
    && endpoint.Contains("issueToken", StringComparison.OrdinalIgnoreCase);

Try / catch

try
{
    translator.Initialize();
}
catch (Exception ex) when (ex.InnerException?.Message.Contains("Could not get access token") == true)
{
    throw new InvalidOperationException("Azure token endpoint rejected the key - verify endpoint region and key.", ex);
}

Prevention

When it happens

Trigger: GetAccessToken POSTs an empty body to the configured token endpoint with Ocp-Apim-Subscription-Key = apiKey; response.IsSuccessStatusCode is false. Typical statuses: 401 (wrong key), 403 (key for wrong resource/region), 404 (wrong endpoint URL).

Common situations: Wrong token endpoint URL (copy-paste error, missing /sts/v1.0/issueToken); key from a different region; key revoked or rotated; endpoint behind a firewall that rewrites responses; free-tier key exhausted.

Related errors

AI-assisted analysis of SubtitleEdit/subtitleedit@17a9f07487 (2026-08-13). Data as JSON: /api/errors/54d3e5fac736626f. Report an issue: GitHub.