# InvalidIavToken

**URL:** <https://discuss.dwolla.com/t/invalidiavtoken/5138>\
**Category:** API Support\
**Created:** [March 25, 2019, 11:02pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138 "2019-03-25T23:02:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![stephenEnact](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@stephenEnact](https://discuss.dwolla.com/u/stephenEnact)\
**Post date:** [March 25, 2019, 11:02pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/1 "2019-03-25T23:02:41Z")

</div>

I am testing creating a funding source through Dwolla.js and am now getting InvalidIavToken. The only guidance for this error mentions getting the same IavToken every time it is run, but I am getting a new one every time.  
I am able to create the customer without any problem. I get a new IAV token, but it is not accepted. Below is the code I am working with, using PHP.  
Thanks for your time.

 \<?php $dwolla\_api\_url = 'https://api-sandbox.dwolla.com'; $apiClient = new DwollaSwagger\ApiClient($dwolla\_api\_url); $customersApi = new DwollaSwagger\CustomersApi($apiClient); $customer = $customersApi-\>create(['firstName' =\> $current\_user-\>user\_firstname, 'lastName' =\> $current\_user-\>user\_lastname, 'email' =\> $current\_user-\>user\_email, 'type' =\> 'receive-only', 'businessName' =\> $b\_name, 'ipAddress' =\> $ip]); $myCustomerId = explode("/",$customer)[4]; //ugly but works for now $myUrl = $dwolla\_api\_url . "/customers/" . $myCustomerId; $iavToken = $customersApi-\>getCustomerIavToken($myUrl); ?\>

```
<script type="text/javascript">
     dwolla.iav.start('<?php echo $iavToken->token; ?>', {
					container: 'iavContainer',
					stylesheets: [
						'https://fonts.googleapis.com/css?family=Lato&subset=latin,latin-ext'
					],
					  microDeposits: false,
					  fallbackToMicroDeposits: true,
					  backButton: true,
					  subscriber: ({ currentPage, error }) => {
						  console.log('currentPage:', currentPage, 'error:', JSON.stringify(error))
						}
					}, function(err, res) {
				  console.log('Error: ' + JSON.stringify(err) + ' -- Response: ' + JSON.stringify(res));
	});

```

Here is a sample of the last javascript from the client:  
\<script type=“text/javascript”\>  
dwolla.iav.start(‘aWLL3WIYAMJNeYKGUiju0XQnghv12wJyvwNCO9lUzDIQxLXfQr’, {  
container: ‘iavContainer’,  
stylesheets: [  
‘[https://fonts.googleapis.com/css?family=Lato&subset=latin,latin-ext](https://fonts.googleapis.com/css?family=Lato&subset=latin,latin-ext)’  
],  
microDeposits: false,  
fallbackToMicroDeposits: true,  
backButton: true,  
subscriber: ({ currentPage, error }) =\> {  
console.log(‘currentPage:’, currentPage, ‘error:’, JSON.stringify(error))  
}  
}, function(err, res) {  
console.log('Error: ’ + JSON.stringify(err) + ’ – Response: ’ + JSON.stringify(res));  
});

---

<div class="post-metadata">

**Author:** ![spencer](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/spencer/32/2143_2.png) [@spencer](https://discuss.dwolla.com/u/spencer)\
**Post date:** [March 26, 2019, 6:48pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/2 "2019-03-26T18:48:03Z")

</div>

Hi @stephenEnact, thanks for posting! After reviewing your code snippet it appears you’re calling our sandbox to fetch an IAV token. By default, dwolla.js will point to our production environment unless a configuration is set to specify sandbox. Referenced [here](https://developers.dwolla.com/resources/dwolla-js.html#configure) in our docs, prior to calling dwolla.iav.start() you’ll want to pass in a configuration of:

```auto
dwolla.configure('sandbox');

```

Hope this helps, let us know if this resolves the issue you are running into!

---

<div class="post-metadata">

**Author:** ![stephenEnact](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@stephenEnact](https://discuss.dwolla.com/u/stephenEnact)\
**Post date:** [March 26, 2019, 7:08pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/3 "2019-03-26T19:08:59Z")

</div>

Thanks. That fixed it. I had that command on the form post, so it hadn’t happened yet.

---

<div class="post-metadata">

**Author:** ![jwald1](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/jwald1/32/2187_2.png) [@jwald1](https://discuss.dwolla.com/u/jwald1)\
**Post date:** [July 9, 2019, 5:08pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/4 "2019-07-09T17:08:57Z")

</div>

I’m also receiving `InvalidIavToken`. Here is the code:

```javascript
dwolla.configure("sandbox")
        dwolla.iav.start(
          TOKEN_FROM_SERVER,
          {
            container: "iavContainer",
            
            microDeposits: false,
            fallbackToMicroDeposits: false,
            backButton: true,
            subscriber: ({ currentPage, error }) => {
              console.log(
                "currentPage:",
                currentPage,
                "error:",
                JSON.stringify(error)
              )
            },
          },
          function(err, res) {
            console.log(
              "Error: " +
                JSON.stringify(err) +
                " -- Response: " +
                JSON.stringify(res)
            )
          }
        ) 

```

Could someone please help?  
Thank you

---

<div class="post-metadata">

**Author:** ![shreya](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/shreya/32/2154_2.png) [@shreya](https://discuss.dwolla.com/u/shreya)\
**Post date:** [July 9, 2019, 6:40pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/5 "2019-07-09T18:40:46Z")

</div>

Hi @jwald1, the InvalidIavToken error indicates that an IAV token has been used already, or has exceeded the expiration period of 1 hour.

Would you be able to confirm if this IAV token was generated more than an hour ago of using, or if it has been used to create another funding-source in your Application?

---

<div class="post-metadata">

**Author:** ![jwald1](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/jwald1/32/2187_2.png) [@jwald1](https://discuss.dwolla.com/u/jwald1)\
**Post date:** [July 9, 2019, 10:27pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/6 "2019-07-09T22:27:25Z")

</div>

Thanks @shreya, the Token was generated a few seconds before using and it wasn’t used before.

---

<div class="post-metadata">

**Author:** ![shreya](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/shreya/32/2154_2.png) [@shreya](https://discuss.dwolla.com/u/shreya)\
**Post date:** [July 10, 2019, 5:28pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/7 "2019-07-10T17:28:06Z")

</div>

Thanks for confirming @jwald1!

There seem to be no errors in the code-snippet that you posted above, and since the IAV token is being generated right before use, all I can think of is if the token endpoint you are calling is the right one. Would you be able to confirm that this is the endpoint your application is calling to generate an IAV token?

> POST [https://api.dwolla.com/customers/{id}/iav-token](https://api.dwolla.com/customers/%7Bid%7D/iav-token)

Also, would you mind posting your Account ID, or any Customer ID in your Sandbox Account? I could check our logs for any issue on our end.

---

<div class="post-metadata">

**Author:** ![jwald1](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/jwald1/32/2187_2.png) [@jwald1](https://discuss.dwolla.com/u/jwald1)\
**Post date:** [July 10, 2019, 6:29pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/8 "2019-07-10T18:29:56Z")

</div>

The URL was the problem! I had `app_token.post "#{customer_link}/funding-sources-token"`, no idea why I used it. Thanks a lot for your help!

---

<div class="post-metadata">

**Author:** ![shreya](https://sea2.discourse-cdn.com/dwolla/user_avatar/discuss.dwolla.com/shreya/32/2154_2.png) [@shreya](https://discuss.dwolla.com/u/shreya)\
**Post date:** [July 11, 2019, 3:10pm UTC](https://discuss.dwolla.com/t/invalidiavtoken/5138/9 "2019-07-11T15:10:36Z")

</div>

Ah, that’s the url for generating a funding-source token which you can use with dwolla.js to securely pass bank account info to the API. This securely adds the bank, but doesn’t verify it. It can be confusing.

You’re welcome!