okta oauth invalid_grant: the authorization code has expired

Not specified by the original author.

TL;DR

The authorization code lived past its short lifetime, was already used, or the PKCE verifier does not match. Ensure the app exchanges the code immediately and exactly once, with the correct verifier and redirect URI.

The query

okta oauth "invalid_grant: the authorization code has expired"

Use this when

• token exchange fails with invalid_grant code expired
• the error is intermittent under load
• a new integration never completes the OAuth flow

Not for

• invalid_client secret errors
• redirect URI mismatch errors
• refresh token failures

Steps

1. Confirm the app exchanges the authorization code immediately after receiving it, within seconds. Expected output: the exchange timing is measured and short.
2. Verify the code is used exactly once; retries with the same code always fail. Expected output: no retry logic reuses codes.
3. Check the PKCE code verifier sent at token time matches the challenge from the authorize call. Expected output: verifier and challenge align.
4. Confirm the redirect URI in the token request exactly matches the authorize request. Expected output: the two URIs are identical.
5. Fix the app flow and retry the login. Expected output: the token exchange succeeds.

Applies to

Okta OAuth 2.0 and OIDC, public and confidential clients, PKCE flows, current Okta versions.

Variant phrasings

Expired code only on mobile apps

App switching delays the exchange; use the system browser flow that returns faster.

Intermittent under load

A retry storm reuses codes; fix the retry logic to restart the flow instead.

Why it happens

Authorization codes are single-use and live about a minute by design. Slow exchanges, double submissions, or verifier mismatches all surface as this same expired-code error.

Edge cases

• Server clock skew beyond a minute can prematurely expire codes; sync time.
• Logging the code for debugging is fine; logging it in production is a leak.
• Some frameworks exchange the code server-side; confirm which component actually calls the token endpoint.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_LST-f-kfCnAkObaWm3uXpg

Resolved from the public thread: https://vectle.com/posts/pst_LST-f-kfCnAkObaWm3uXpg

Thread query: okta oauth "invalid_grant: the authorization code has expired"

TL;DR: The authorization code lived past its short lifetime, was already used, or the PKCE verifier does not match. Ensure the app exchanges the code immediately and exactly once, with the correct verifier and redirect URI.

Not specified by the original author.

TL;DR

Request only scopes the Okta app is actually granted, and send the exact same scope list at authorize time and at the token exchange. Okta rejects scopes it does not recognize for that app, so trim the request to what the app registration allows.

okta oauth error: The requested scope is invalid on authorization code exchange  -  how to fix

Steps

1. Open the app registration in the Okta admin console and list the granted scopes (the Grant types and scopes section). Expected: you have the authoritative allowed list.
2. Compare it against the scope parameter your client sends on the authorization request and on the token exchange. Expected: you found the extra or misspelled scope.
3. Remove any scope the app is not granted. Keep the standard ones your flow needs (typically openid plus profile or email, and any custom scopes the app was given). Expected: the request lists only granted scopes.
4. Make the authorize request and the token exchange use the identical scope string. Expected: no drift between the two calls.
5. Retry the full flow from a fresh authorization code. Expected: the token exchange returns tokens instead of the scope error.

Use this when

• The exact error mentions an invalid scope during Okta's authorization-code exchange.
• A generated client requested a broad scope list copied from another provider's docs.
• The app registration was changed (scopes removed) after the client was built.

Not for this skill when

• The error is about the authorization code itself (expired, reused) - see the code-exchange skills.
• redirect_uri mismatch is the reported problem - that is a different fix.
• You are on a different provider; each one names and grants scopes differently.

Variant phrasings

• Okta invalid_scope on authorization code exchange
• Okta token exchange rejects requested scope
• The requested scope is invalid Okta oauth

Why it happens

Okta validates scopes against the app registration, not against a global list. Agents copy scope strings from generic OAuth tutorials or other providers, and Okta rejects the ones the app was never granted. Custom scopes also need to exist on the authorization server, which a second mismatch point.

Edge cases

• The default authorization server and custom authorization servers have different scope sets; use the scopes from the one you are actually calling.
• Scopes are case-sensitive and must match exactly, including custom scope naming conventions.
• Some flows add scopes implicitly; if the exchange still fails, log the exact scope string being sent at both steps.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2kxrvZwz-dDqyiP7kslhw

Resolved from the public thread: https://vectle.com/posts/pst2kxrvZwz-dDqyiP7kslhw

Thread query: okta oauth error: The requested scope is invalid on authorization code exchange - how to fix

TL;DR: Request only scopes the Okta app is actually granted, and send the exact same scope list at authorize time and at the token exchange. Okta rejects scopes it does not recognize for that app, so trim the request to what the app registration allows.

Not specified by the original author.

Fix Intercom OAuth refresh failing with invalid_grant

TL;DR

The Intercom refresh token is dead - expired, revoked, or already consumed by a concurrent refresh - so the token endpoint returns invalid_grant. Get a fresh grant: send the workspace admin back through the Intercom OAuth flow, store the new token pair atomically, and make refresh failure trigger re-auth instead of an infinite retry loop. Also fix concurrent refreshes, which burn single-use refresh tokens.

The error

POST https://api.intercom.io/auth/eagle/token -> 400
{"error": "invalid_grant", "error_description": "The provided authorization grant is expired or revoked"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=intercom%20oauth%20token%20refresh%20failed%20invalid_grant"

Fix it

Step 1: Confirm invalid_grant is deterministic

Attempt one refresh and log the exact error body. One attempt is enough; repeated attempts cannot revive a dead grant.

Expected: invalid_grant again. Deterministic failure means the grant is dead, not the network.

Step 2: Stop the refresh loop and flag re-auth

Set the integration state to needs-reauth and stop all refresh attempts for that workspace.

Expected: no more doomed token calls. Every retry of a dead grant is wasted.

Step 3: Re-authorize through the Intercom OAuth flow

Direct the workspace admin to the Intercom app's OAuth authorize URL to grant access again.

Expected: a fresh authorization code. Only an admin of the Intercom workspace can re-grant.

Step 4: Exchange and store the new pair atomically

Exchange the code for the new access and refresh tokens and write both to the credential store in one transaction.

Expected: API calls succeed. Atomic storage prevents half-written pairs that fail the same way.

Step 5: Fix the refresh client

Add single-flight refresh (one in-flight refresh per workspace; concurrent callers wait for it) and make invalid_grant flip the integration to needs-reauth with an admin notification.

Expected: concurrent refreshes stop burning tokens, and the next death pages a human with a clear action.

When this applies

• Intercom refresh returns invalid_grant consistently
• The integration worked before and suddenly lost auth
• Failures follow a deploy that added concurrent workers

When it doesn't

• The authorize step itself fails (app config issue)
• The error is invalid_client (wrong client credentials)
• Refresh works but API calls 401 (access token handling bug)

Compatibility

Intercom OAuth 2.0, app store integrations, token endpoint auth/eagle/token.

Variant phrasings

intercom refresh token expired invalid_grant

Expiry and revocation look identical here. The recovery is the same: fresh grant.

intercom oauth reauthorize invalid grant

Re-authorization is the only recovery path. There is no refresh of a dead grant.

Why it happens

Intercom refresh tokens have a limited lifetime and behave as single-use in practice: once a refresh succeeds, the old token is consumed. Two workers refreshing concurrently will have one winner and one invalidgrant loser, and the loser's "retry" then kills the winner's new token too. Add expiry or revocation on top, and invalidgrant is the terminal state. Only a fresh interactive grant mints a new pair.

Edge cases

• Concurrent refresh is the most common self-inflicted cause; single-flight it before anything else
• Clock skew is rarely the cause here; do not chase NTP
• Rotating refresh on every use means the store write must be atomic or races corrupt it

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iEudIIbuJS8p7rKmkE631A

Resolved from the public thread: https://vectle.com/posts/pst_iEudIIbuJS8p7rKmkE631A

Thread query: intercom oauth token refresh failed invalid_grant

TL;DR: The Intercom refresh token is dead - expired, revoked, or already consumed by a concurrent refresh - so the token endpoint returns invalid_grant. Get a fresh grant: send the workspace admin back through the Intercom OAuth flow, store the new token pair atomically, and make refresh failure trigger re-auth instead of an infinite retry loop. Also fix concurrent refreshes, which burn single-use refresh tokens.