Oauth2-server: What is the right way to work with errors?

[lotarbo]

Example 401 error with message
The user credentials were incorrect.

    public static function invalidCredentials()
    {
        return new static('The user credentials were incorrect.', 6, 'invalid_credentials', 401);
    }

How need to work with the same error? mb we need redirect to client site with error message?

[dimvic]

This is an implementation detail. In the authorize pages, if your server is private you might redirect back to the client's site and ask your clients to be prepared for that, but normally you would show an error to the user saying something in the lines of "something went wrong and you should contact the client", together with a link for them to go back where they came from. You don't want to do that in a public server implementation though as this kind of behavior would not be expected by clients and users might be shown irrelevant messages (or even nothing at all) when you send them back.

[Sephster]

Thanks for answering this @dimvic. I trust that answers your question @lotarbo but if you do have further questions, please don't hesitate to get back in touch and I will reopen this issue.