https://support.mashery.com/docs/read/mashery_api/20/oauth_supporting_methods/OAuth_Generated_Errors
The column on the left is for calls to /token the column on the right is calls to the API once you have an access token.
Hopefully this can clear up a bunch of confusion. Please note that the same X-Mashery-Error-Code header and body can be received for different types of errors.