ARB - Invalid OTS Token

[HerrimanCoder]

The full XML of my ARB request is below, with credentials obfuscated. When I execute this in the test runner (https://developer.authorize.net/api/reference/index.html#recurring-billing-create-a-subscription) it works fine - SUCCESS. But when I run it from my local machine (yes I have valid SSL set up) I get "Invalid OTS Token".

I am running this in the sandbox: https://apitest.authorize.net/xml/v1/request.api

<ARBCreateSubscriptionRequest xmlns="AnetApi/xml/v1/schema/AnetApiSchema.xsd">
<merchantAuthentication>
<name>2fs.....Jh</name>
<transactionKey>4c2......xk</transactionKey>
</merchantAuthentication>
<subscription>
<name>Monthly Trash Service</name>
<paymentSchedule>
<interval>
<length>1</length>
<unit>months</unit>
</interval>
<startDate>2022-09-16</startDate>
<totalOccurrences>9999</totalOccurrences>
<trialOccurrences>0</trialOccurrences>
</paymentSchedule>
<amount>3.96</amount>
<trialAmount>0.00</trialAmount>
<payment>
<opaqueData>
<dataDescriptor>COMMON.ACCEPT.INAPP.PAYMENT</dataDescriptor>
<dataValue>eyJjb2RlIjoiNTBfMl8wNjAwMDUzMERCMTU1RkY4NjQ2RDUwOEE1MUI4RUQ0RDUwRjczMDU0OUQ5QUYwNzY5NjE4QTQ5MTM5QjU1REVENjZERTMyRkIxMEY2MDU2NjBBNkVFN0I4QzcwRDZGNzc0RUQ4NDc0IiwidG9rZW4iOiI5NjYzMzM2ODI1ODc2MDc3MTA0NjAxIiwidiI6IjEuMSJ9</dataValue>
</opaqueData>
</payment>
<billTo>
<firstName>Frank</firstName>
<lastName>Sinatra</lastName>
<address>123 Sunset Ave.</address>
<city>Hunt</city>
</billTo>
</subscription>
</ARBCreateSubscriptionRequest>

IMPORTANT: From my same localhost machine and within the same webapp I can send createTransactionRequest and it works fine - SUCCESS. It's only ARB requests that throw the error. This means that it can't be related to SSL or certificates or credentials, etc - else the createTransactionRequest would also fail.

This error occurs every time - 100% reproducible.

Thanks in advance for any advice.

[HerrimanCoder]

I found the solution after a lot of searching online. It turns out that for ARB you need a delay after getting the nonce and before making the final call. For my PHP implementation, sleep(5) solved it for me.

Share on authnet for allowing this nasty bug to continue for so long. If they're going to do this, they should at least include the error message something like "Consider adding a 5 second sleep before making the call". But WHY can't authnet just put the sleep on their own side, since they know it's required, else failure??

[HerrimanCoder]

*shame not share

[TFlexSoom]

Anyone on the dev side able to clarify how long sleep is necessary and why it is necessary?