Answer
Separate an authentication failure from an authorization failure first — they need different fixes. A failure right at the token request (before any API call happens) almost always means the new secret isn't what the client is actually sending yet, not a permissions problem. See authenticate and get access.
Work through these checks
- Identify the failed boundary: the token endpoint or the later business API request. Record sanitized status/error details without copying secrets or tokens.
- Compare the token URL, client identity, grant type, and active secret reference with the approved environment configuration. Check that the running client has loaded the rotated value.
- Request a new token using the supported flow. If it fails, investigate the identity-provider response before changing business permission sets.
- With a fresh token, call the smallest permitted operation. If token issuance works but the API denies access, investigate audience, identity, and grants separately.