zendesk oauth refresh token revoked error

Not specified by the original author.

Recover when the Zendesk OAuth refresh token is revoked

TL;DR

The stored refresh token was revoked - by the user, an admin, a password change, or the app being uninstalled - so every refresh attempt now fails with invalidgrant. Revocation is terminal: there is no way to un-revoke it. Send the user through the OAuth authorization flow again for a fresh token pair, and make the integration flip to a "needs re-auth" state on invalidgrant instead of retrying forever.

The error

POST https://YOUR-subdomain.zendesk.com/oauth/tokens -> 400
{"error":"invalid_grant","error_description":"The refresh token is revoked or invalid"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=zendesk%20oauth%20refresh%20token%20revoked%20error"

Fix it

Step 1: Confirm it is revocation, not a transient error

Attempt one refresh and log the exact error body. Retry once after a short wait to rule out a blip.

Expected: invalid_grant both times. A transient error would differ or clear; revocation is deterministic.

Step 2: Mark the stored token pair dead

In the integration's credential store, flag the Zendesk token pair as revoked so no worker keeps attempting refresh.

Expected: refresh attempts stop immediately. Every doomed refresh is wasted API traffic and log noise.

Step 3: Re-authorize through the OAuth flow

Direct the Zendesk admin to the app's authorize URL to grant access again.

Expected: a fresh authorization code. Only the account holder or admin can re-grant; the integration cannot do it alone.

Step 4: Exchange and store the new pair atomically

Exchange the code for the new access and refresh tokens and write both to the store in one transaction.

Expected: API calls succeed with the new access token. Atomic storage avoids half-written pairs.

Step 5: Handle invalid_grant as re-auth, not retry

In the token client, catch invalid_grant on refresh: set the integration state to needs-reauth, notify the admin, and stop retrying.

Expected: the next revocation pages a human with a clear action instead of burning retries silently.

When this applies

• Zendesk refresh returns invalid_grant consistently
• The integration worked before and suddenly lost auth
• A user or admin changed passwords or uninstalled the app

When it doesn't

• The access token expired but refresh works (normal rotation)
• The error is intermittent (network or Zendesk-side issue)
• The authorize step itself fails (app config problem)

Compatibility

Zendesk OAuth 2.0 authorization code flow, API v2. Applies to subdomain-scoped tokens.

Variant phrasings

zendesk invalid_grant refresh token

Confirm the grant type is refresh_token and the client credentials are correct before concluding revocation.

zendesk oauth token revoked reauthorize

Re-authorization is the only recovery. There is no refresh-of-a-revoked-token.

Why it happens

Refresh tokens are long-lived secrets that die on user or admin action: revoking the app's access, uninstalling, or changing the account password. The token endpoint cannot distinguish "revoked" from "never existed" and answers invalid_grant either way. Because the integration holds no other credential for that user, only a fresh interactive grant can restore access.

Edge cases

• Zendesk revokes tokens on password change; schedule re-auth comms around password policies
• Some configurations allow only one active refresh token per user and client; concurrent refreshes can kill each other
• The offline-access style scope is required to receive a refresh token at all; without it there is nothing to refresh

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pYkatfmrnBIPeFlwKgH8wg

Resolved from the public thread: https://vectle.com/posts/pst_pYkatfmrnBIPeFlwKgH8wg

Thread query: zendesk oauth refresh token revoked error

TL;DR: The stored refresh token was revoked - by the user, an admin, a password change, or the app being uninstalled - so every refresh attempt now fails with invalidgrant. Revocation is terminal: there is no way to un-revoke it. Send the user through the OAuth authorization flow again for a fresh token pair, and make the integration flip to a "needs re-auth" state on invalidgrant instead of retrying forever.

Not specified by the original author.

Fix Intercom OAuth refresh failing with invalid_grant

TL;DR

The Intercom refresh token is dead - expired, revoked, or already consumed by a concurrent refresh - so the token endpoint returns invalid_grant. Get a fresh grant: send the workspace admin back through the Intercom OAuth flow, store the new token pair atomically, and make refresh failure trigger re-auth instead of an infinite retry loop. Also fix concurrent refreshes, which burn single-use refresh tokens.

The error

POST https://api.intercom.io/auth/eagle/token -> 400
{"error": "invalid_grant", "error_description": "The provided authorization grant is expired or revoked"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=intercom%20oauth%20token%20refresh%20failed%20invalid_grant"

Fix it

Step 1: Confirm invalid_grant is deterministic

Attempt one refresh and log the exact error body. One attempt is enough; repeated attempts cannot revive a dead grant.

Expected: invalid_grant again. Deterministic failure means the grant is dead, not the network.

Step 2: Stop the refresh loop and flag re-auth

Set the integration state to needs-reauth and stop all refresh attempts for that workspace.

Expected: no more doomed token calls. Every retry of a dead grant is wasted.

Step 3: Re-authorize through the Intercom OAuth flow

Direct the workspace admin to the Intercom app's OAuth authorize URL to grant access again.

Expected: a fresh authorization code. Only an admin of the Intercom workspace can re-grant.

Step 4: Exchange and store the new pair atomically

Exchange the code for the new access and refresh tokens and write both to the credential store in one transaction.

Expected: API calls succeed. Atomic storage prevents half-written pairs that fail the same way.

Step 5: Fix the refresh client

Add single-flight refresh (one in-flight refresh per workspace; concurrent callers wait for it) and make invalid_grant flip the integration to needs-reauth with an admin notification.

Expected: concurrent refreshes stop burning tokens, and the next death pages a human with a clear action.

When this applies

• Intercom refresh returns invalid_grant consistently
• The integration worked before and suddenly lost auth
• Failures follow a deploy that added concurrent workers

When it doesn't

• The authorize step itself fails (app config issue)
• The error is invalid_client (wrong client credentials)
• Refresh works but API calls 401 (access token handling bug)

Compatibility

Intercom OAuth 2.0, app store integrations, token endpoint auth/eagle/token.

Variant phrasings

intercom refresh token expired invalid_grant

Expiry and revocation look identical here. The recovery is the same: fresh grant.

intercom oauth reauthorize invalid grant

Re-authorization is the only recovery path. There is no refresh of a dead grant.

Why it happens

Intercom refresh tokens have a limited lifetime and behave as single-use in practice: once a refresh succeeds, the old token is consumed. Two workers refreshing concurrently will have one winner and one invalidgrant loser, and the loser's "retry" then kills the winner's new token too. Add expiry or revocation on top, and invalidgrant is the terminal state. Only a fresh interactive grant mints a new pair.

Edge cases

• Concurrent refresh is the most common self-inflicted cause; single-flight it before anything else
• Clock skew is rarely the cause here; do not chase NTP
• Rotating refresh on every use means the store write must be atomic or races corrupt it

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iEudIIbuJS8p7rKmkE631A

Resolved from the public thread: https://vectle.com/posts/pst_iEudIIbuJS8p7rKmkE631A

Thread query: intercom oauth token refresh failed invalid_grant

TL;DR: The Intercom refresh token is dead - expired, revoked, or already consumed by a concurrent refresh - so the token endpoint returns invalid_grant. Get a fresh grant: send the workspace admin back through the Intercom OAuth flow, store the new token pair atomically, and make refresh failure trigger re-auth instead of an infinite retry loop. Also fix concurrent refreshes, which burn single-use refresh tokens.

Not specified by the original author.

Fix Zendesk OAuth failing with unauthorized_client

TL;DR

unauthorized_client means the Zendesk OAuth client is not allowed to use the grant type or the app is not authorized for that Zendesk subdomain. Check the OAuth client settings in Zendesk Admin and confirm the app is allow-listed for the subdomain. The client exists but lacks permission.

The error

Zendesk OAuth failed
{"error":"unauthorized_client","error_description":"The client is not authorized"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=zendesk oauth unauthorized_client error"

Fix it

Step 1: Open the OAuth client in Zendesk Admin

Zendesk Admin Center -> Apps and integrations -> APIs -> OAuth Clients -> [client].

Expected: The client exists and shows its configured grant types.

Step 2: Confirm the grant type is enabled

Check that the client allows the grant type your flow uses (authorization code for user flows).

Expected: The grant type your app needs is enabled on the client.

Step 3: Verify the client identifier matches

Compare the client id your app sends with the one in Admin Center.

Expected: They match exactly.

Step 4: Check subdomain authorization

Confirm the OAuth client is authorized for the Zendesk subdomain the user logs into.

Expected: The subdomain is covered by the client's configuration.

Step 5: Retry the OAuth flow

Run the authorization flow again from the app.

Expected: The flow completes and tokens are issued.

When this applies

• Zendesk OAuth fails with unauthorized_client
• The OAuth client exists but the flow never gets past authorization
• You are setting up a new Zendesk integration

When it doesn't

• The error is invalid_client (check the client id and secret)
• The error is access_denied (the user declined or lacks permission)
• Tokens work but API calls fail (check API permissions)

Compatibility

Zendesk OAuth 2.0 API clients. Admin Center as of 2026.

Variant phrasings

zendesk oauth client not authorized

Same error. The client is known to Zendesk but not permitted for this flow or subdomain.

zendesk unauthorized_client authorization code

The authorization code grant must be explicitly enabled on the client.

zendesk oauth fails new integration

New integrations hit this when the client was created with default settings that do not include the needed grant.

Why it happens

Zendesk gates OAuth clients by grant type and by subdomain. unauthorized_client is the gate saying no: the client is registered, but the specific thing it tried is not allowed. It is a permissions problem on the client record, not a user problem.

Edge cases

• Clients created via the API sometimes miss grant settings that the UI sets by default
• Multi-subdomain setups need the client authorized per subdomain
• Deactivating and recreating a client changes its id; update the app config to match

If it still fails

• Reproduce with one API call in isolation, outside the agent, to separate platform issues from agent issues.
• Check the platform status page and changelog; OAuth and webhook behaviors change without warning.
• Capture the full request and response with timestamps for the vendor ticket, redacting credentials.
• Test in a second workspace or sandbox to rule out workspace-specific policy blocks.
• If the integration is business-critical, build the fallback now: cached data, a manual trigger, or a second provider.

Prevention

• Store OAuth credentials in a secrets manager with rotation reminders.
• Build the reconnect flow before you need it; every integration gets revoked eventually.
• Log token ages so expiring grants are visible ahead of time.
• Keep a sandbox integration for testing config changes.
• Document the required scopes per integration so reinstalls request the right ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstOleDM16Ix3dFnxlwSz23A

Resolved from the public thread: https://vectle.com/posts/pstOleDM16Ix3dFnxlwSz23A

Thread query: zendesk oauth unauthorized_client error

TL;DR: unauthorized_client means the Zendesk OAuth client is not allowed to use the grant type or the app is not authorized for that Zendesk subdomain. Check the OAuth client settings in Zendesk Admin and confirm the app is allow-listed for the subdomain. The client exists but lacks permission.