Webmaster API rejects every OAuth access token with “ERROR!!! InvalidToken” since Oct 14, 2026 (token endpoint still issues them)

Since about 2026-10-14 04:00 UTC, every Bing Webmaster API call made with an OAuth access token fails with:

HTTP 400
{"ErrorCode":18,"Message":"ERROR!!! InvalidToken"}

The same integration had worked daily since September 25. The last successful call was on 2026-10-13 at 07:02 UTC. Nothing changed on our side: same code, same OAuth client, same redirect URI.

Setup

• OAuth client registered in Bing Webmaster Tools → Settings → API access → OAuth Client. It’s still listed, and the redirect URI is unchanged.
• Authorization code flow: https://www.bing.com/webmasters/oauth/authorize with scope=webmaster.read.
• Token endpoint: https://www.bing.com/webmasters/oauth/token.
• API calls: JSON endpoint, GET .../webmaster/api.svc/json/GetUserSites (also GetRankAndTrafficStats, GetCrawlStats, GetFeeds), with the header Authorization: Bearer <access_token>.

What happens

1. Authorization code exchange: HTTP 200, token_type: Bearer, expires_in: 3600, scope: Read, an access token of 980 characters, and a refresh token.
2. Calling GetUserSites with that access token about a second later: HTTP 400, ErrorCode 18, InvalidToken.
3. Refreshing (grant_type=refresh_token): HTTP 200 with a new access token. Calling the API with it gives the same InvalidToken.
4. It’s the same on both hosts, https://www.bing.com/webmaster/api.svc/json/ and https://ssl.bing.com/webmaster/api.svc/json/.

What I’ve ruled out

• Stale or expired grants: it fails for the token from a brand-new sign-in (made 2026-10-14 at 09:11 UTC), within a second of issuing it.
• Refresh-token rotation: a fresh authorization code exchange fails the same way.
• Per-site permissions: it fails for several verified sites at once, with grants created between September 25 and October 14. All of them broke on the same night.
• Client configuration: the OAuth client is still present, with no new terms to accept.

Questions

1. Did something change around October 13–14 in how the Webmaster API validates OAuth access tokens?
2. Is webmaster.read still a supported scope for the JSON API’s read methods, or is webmaster.manage now required?
3. Is there anything on the OAuth client or account side that would make the token endpoint issue tokens the API then rejects?

Minimal reproduction (the token is a placeholder):

curl -i "https://www.bing.com/webmaster/api.svc/json/GetUserSites" \
  -H "Authorization: Bearer <access_token from the token endpoint>" \
  -H "Accept: application/json"