The webservice could have better error messages. For eg: we could give the exact reason why the token was deemed invalid rather than having a general response for any error.

See: https://bitbucket.org/dufferzafar/critiquebrainz/src/ecb60e87a91128387ad012c95a42910559f567cd/critiquebrainz/ws/oauth/provider.py?at=test-coverage#cl-195

https://bitbucket.org/dufferzafar/critiquebrainz/src/ecb60e87a91128387ad012c95a42910559f567cd/critiquebrainz/ws/oauth/exceptions.py?at=test-coverage#cl-53