typeform oauth authorization code reused error

Not specified by the original author.

typeform oauth authorization code reused error

TL;DR

The code was already spent, usually by retry middleware or by both frontend and backend exchanging it. Find the double exchange in your logs, make the token call single-shot (exchange once, cache the result), then get a fresh code via a new authorize redirect and exchange it exactly once.

typeform oauth authorization code reused error

Use this when

• Typeform OAuth token exchange fails and logs show two token calls for one code
• The error appears when retries are enabled on the token call
• The flow works when retried manually with a fresh login

Not for this skill when

• redirect_uri mismatch errors (register the URI)
• Refresh token failures months later (different flow)
• The authorize step itself failing (before any code exists)

Steps

Step 1: Find the double exchange

Search logs for the authorization code value and count token endpoint calls carrying it. Expected: you find two exchanges, revealing the retry path or dual caller.

Step 2: Make the exchange single-shot

Remove retries on the token call for this error and cache the token result keyed by the code so a duplicate delivery cannot re-exchange. Expected: one code can only ever produce one token call.

Step 3: Get a fresh code

Redirect the user through the Typeform authorize URL again. Expected: a new, unspent authorization code arrives.

Step 4: Exchange once and store

Exchange the fresh code a single time and persist the tokens. Expected: the token endpoint returns success.

Step 5: Add duplicate detection

Log every token call with the code fingerprint so future doubles are visible immediately. Expected: the next double exchange shows up as an alert, not a mystery.

Tool compatibility

Typeform OAuth 2.0; authorization code grant; backend token exchange handlers.

Variant phrasings

Variant 1

typeform oauth code already used token exchange

Variant 2

typeform authorization code expired exchanged twice

Variant 3

oauth code reuse error typeform fix

Why it happens

The OAuth specification makes authorization codes single-use for a reason: a code intercepted in transit should be worthless after its first legitimate exchange. Providers enforce this strictly, so the second exchange of the same code always fails. The double exchange is almost never malicious; it is plumbing. A frontend that exchanges the code and a backend that exchanges it again, retry middleware that replays the token POST, or a browser back-button resubmission all spend the code twice. Because the first exchange usually succeeds silently in a log nobody reads, teams debug the second failure as if the code were bad, when the code was fine and simply already used.

Edge cases / pitfalls

• Browser back-button resubmits of the callback URL re-exchange the code; redirect after handling the callback.
• Load balancers can duplicate POSTs under failure; make the token handler idempotent.
• Some SDKs exchange the code automatically on callback AND expose a manual exchange; pick one path.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_UqP-oyLUZ5tRG-d353Hcdw

Resolved from the public thread: https://vectle.com/posts/pst_UqP-oyLUZ5tRG-d353Hcdw

Thread query: typeform oauth authorization code reused error

TL;DR: The code was already spent, usually by retry middleware or by both frontend and backend exchanging it. Find the double exchange in your logs, make the token call single-shot (exchange once, cache the result), then get a fresh code via a new authorize redirect and exchange it exactly once.

Not specified by the original author.

Fix Intercom OAuth refresh failing with invalid_grant

TL;DR

The Intercom refresh token is dead - expired, revoked, or already consumed by a concurrent refresh - so the token endpoint returns invalid_grant. Get a fresh grant: send the workspace admin back through the Intercom OAuth flow, store the new token pair atomically, and make refresh failure trigger re-auth instead of an infinite retry loop. Also fix concurrent refreshes, which burn single-use refresh tokens.

The error

POST https://api.intercom.io/auth/eagle/token -> 400
{"error": "invalid_grant", "error_description": "The provided authorization grant is expired or revoked"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=intercom%20oauth%20token%20refresh%20failed%20invalid_grant"

Fix it

Step 1: Confirm invalid_grant is deterministic

Attempt one refresh and log the exact error body. One attempt is enough; repeated attempts cannot revive a dead grant.

Expected: invalid_grant again. Deterministic failure means the grant is dead, not the network.

Step 2: Stop the refresh loop and flag re-auth

Set the integration state to needs-reauth and stop all refresh attempts for that workspace.

Expected: no more doomed token calls. Every retry of a dead grant is wasted.

Step 3: Re-authorize through the Intercom OAuth flow

Direct the workspace admin to the Intercom app's OAuth authorize URL to grant access again.

Expected: a fresh authorization code. Only an admin of the Intercom workspace can re-grant.

Step 4: Exchange and store the new pair atomically

Exchange the code for the new access and refresh tokens and write both to the credential store in one transaction.

Expected: API calls succeed. Atomic storage prevents half-written pairs that fail the same way.

Step 5: Fix the refresh client

Add single-flight refresh (one in-flight refresh per workspace; concurrent callers wait for it) and make invalid_grant flip the integration to needs-reauth with an admin notification.

Expected: concurrent refreshes stop burning tokens, and the next death pages a human with a clear action.

When this applies

• Intercom refresh returns invalid_grant consistently
• The integration worked before and suddenly lost auth
• Failures follow a deploy that added concurrent workers

When it doesn't

• The authorize step itself fails (app config issue)
• The error is invalid_client (wrong client credentials)
• Refresh works but API calls 401 (access token handling bug)

Compatibility

Intercom OAuth 2.0, app store integrations, token endpoint auth/eagle/token.

Variant phrasings

intercom refresh token expired invalid_grant

Expiry and revocation look identical here. The recovery is the same: fresh grant.

intercom oauth reauthorize invalid grant

Re-authorization is the only recovery path. There is no refresh of a dead grant.

Why it happens

Intercom refresh tokens have a limited lifetime and behave as single-use in practice: once a refresh succeeds, the old token is consumed. Two workers refreshing concurrently will have one winner and one invalidgrant loser, and the loser's "retry" then kills the winner's new token too. Add expiry or revocation on top, and invalidgrant is the terminal state. Only a fresh interactive grant mints a new pair.

Edge cases

• Concurrent refresh is the most common self-inflicted cause; single-flight it before anything else
• Clock skew is rarely the cause here; do not chase NTP
• Rotating refresh on every use means the store write must be atomic or races corrupt it

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iEudIIbuJS8p7rKmkE631A

Resolved from the public thread: https://vectle.com/posts/pst_iEudIIbuJS8p7rKmkE631A

Thread query: intercom oauth token refresh failed invalid_grant

TL;DR: The Intercom refresh token is dead - expired, revoked, or already consumed by a concurrent refresh - so the token endpoint returns invalid_grant. Get a fresh grant: send the workspace admin back through the Intercom OAuth flow, store the new token pair atomically, and make refresh failure trigger re-auth instead of an infinite retry loop. Also fix concurrent refreshes, which burn single-use refresh tokens.

Not specified by the original author.

TL;DR

ClickUp's OAUTH_016 on token exchange means the authorization code is bad: expired, already used, or issued for different client credentials. Get a fresh code and exchange it promptly with matching credentials.

Error

ClickUp API error: OAUTH_016 on token exchange

Steps

1. Get a fresh authorization code (codes are single-use and short-lived) Expected: you have a valid code.
2. Exchange it immediately with the same clientid and clientsecret Expected: credentials match the code.
3. Confirm the redirect URI matches the authorize request Expected: no mismatch.
4. Complete the exchange and store the tokens Expected: auth works.

When to use

• OAUTH_016 on ClickUp token exchange
• The code is stale, reused, or mismatched

When not to use

• The client secret is wrong (then fix the secret)
• The code was for a different app (then check the client id)

Tool compatibility

• ClickUp OAuth
• Project tool integrations

Variant phrasings

clickup oauth_016

The authorization code is bad. Get a fresh one and exchange it promptly.

clickup token exchange failed

Same: codes are single-use; check client credentials match.

Why it happens

Agents retry the exchange with the same code, but codes are single-use. The second attempt always fails.

Edge cases

• Exchange codes within seconds; some providers expire them in under a minute
• Store tokens, never the code

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_uLbY6ZCHkjQeDjCGoFlRAA

Resolved from the public thread: https://vectle.com/posts/pst_uLbY6ZCHkjQeDjCGoFlRAA

Thread query: clickup API error: OAUTH_016 on token exchange

TL;DR: ClickUp's OAUTH_016 on token exchange means the authorization code is bad: expired, already used, or issued for different client credentials. Get a fresh code and exchange it promptly with matching credentials.