Error Reference

Every SDK error is a typed class carrying a stable code string:

interface SdkError {
  code: string;      // stable machine-readable identifier (branch on THIS)
  message: string;   // human display text; may be localized or reworded in any release
  retryable: boolean;// whether an identical retry may succeed
}

class NetworkError     extends Error implements SdkError { /* code: NETWORK_ERROR */ }
class TimeoutError     extends Error implements SdkError { /* code: TIMEOUT */ }
class RateLimitError   extends Error implements SdkError { /* retryAfterMs: number */ }
class UnauthorizedError extends Error implements SdkError { /* code: UNAUTHORIZED */ }
class ForbiddenError   extends Error implements SdkError { /* code: FORBIDDEN */ }
class SessionExpiredError extends Error implements SdkError { /* code: SESSION_EXPIRED */ }
class ServerError       extends Error implements SdkError { /* code: SERVER_ERROR */ }

message is for humans, code is for code. Never branch on message content; branch only on code or the error class. Messages may be localized or reworded in any release.

Common errors (all modules)

Code	Error class	HTTP status	Trigger condition	Retryable	Client action
NETWORK_ERROR	NetworkError	none (no response)	Connection failure, DNS, offline	Yes (transport auto-retries idempotent requests first)	Show offline state; retry on user action
TIMEOUT	TimeoutError	none (no response)	Request exceeded the transport timeout (see Security § Transport Policy)	Yes	Retry; persistent timeouts → show degraded state
RATE_LIMITED	RateLimitError	429	Rate limit or lockout exceeded; carries retryAfterMs (from Retry-After)	After retryAfterMs	Disable the action; surface wait time
TOO_MANY_ATTEMPTS	TooManyAttemptsError	429	Per-surface attempt cap exceeded before a full lockout (auth 2FA codes, wallet deposit OTP codes)	After retryAfterMs	Refuse further attempts; surface wait time
UNAUTHORIZED	UnauthorizedError	401	Missing/expired access token AND refresh failed or was not attempted	No (SDK already retried once)	Route to login. This is the request-level rejection; the app-level session-expired event fires once alongside it
FORBIDDEN	ForbiddenError	403	Authenticated but not permitted (e.g., KYC-gated action)	No	Show permission state; never re-authenticate
SESSION_EXPIRED	SessionExpiredError	none (client-side)	Refresh failed terminally (invalid/rotated/revoked token, family revocation, reuse detection); the app-level notification fires once per expiry	No	Fired with the session-expired event; return to login
SERVER_ERROR	ServerError	500	Server error with no recognized module code, surfaced after transport retries	Yes	Show error state; retry on user action

Transport-level behavior (timeouts, 5xx retry/backoff, 429 handling) is defined once in Security & Architecture § Transport Policy.

Module-specific errors

Module	Where
Auth & Identity	State & Security
Wallet & Ledger	Wallet Overview
Games	Launching Games · Round History
Responsible Gaming	Financial Limits · Self-Exclusion
Messaging	Inbox & Preferences
Engagement	per engine page; see Engagement Overview
Support	Live Chat & Widgets
Content	Dynamic Configuration
Analytics	deliberately none: track() never throws and flush outcomes are internal (see Architecture & Batching)