jira oauth error invalid_code grant type

Not specified by the original author.

jira oauth error invalid_code grant type

TL;DR

An invalid_code almost always means the authorization code was already used or has expired. Log your token exchanges and confirm the code is exchanged exactly once, within its short lifetime, with a redirect URI byte-identical to the one registered. Then start a fresh authorize flow and exchange the new code promptly.

jira oauth error invalid_code grant type

Use this when

• Jira OAuth fails at the token step with invalid_code
• The error appears intermittently, especially under retries
• The integration worked in testing but fails in production traffic

Not for this skill when

• invalidclient or invalidsecret errors (credential problem instead)
• Refresh token failures on long-lived integrations (different flow)
• User-facing consent screen errors (happens before any code exists)

Steps

Step 1: Confirm single exchange

Add logging around the token endpoint call and check whether the same authorization code is being exchanged more than once (retry middleware plus manual retry is the classic double). Expected: each code appears in exactly one token request.

Step 2: Verify the redirect URI matches exactly

Compare the redirect_uri sent in the authorize request, the token request, and the registered app settings, character by character including trailing slashes. Expected: all three are identical.

Step 3: Check the code lifetime

Confirm how long the code sat between issuance and exchange; most providers allow minutes, some only one. Expected: the exchange happens within seconds of the callback.

Step 4: Start a fresh authorize flow

Send the user through the authorize URL again to mint a brand-new code. Expected: a new code arrives at your callback.

Step 5: Exchange once, immediately

Exchange the fresh code a single time right away and store the resulting tokens. Expected: the token endpoint returns an access token instead of invalid_code.

Step 6: Harden the exchange path

Make the token exchange non-retryable on invalid_code and alert on it, since retrying a burned code can never succeed. Expected: future double-exchange bugs surface as alerts, not silent failures.

Tool compatibility

Jira Cloud OAuth 2.0 (3LO); OAuth 2.0 authorization code grant; any backend exchanging codes at the token endpoint.

Variant phrasings

Variant 1

jira oauth invalid_code authorization code expired

Variant 2

jira 3lo oauth token exchange invalid_code fix

Variant 3

oauth authorization code already used invalid_code jira

Why it happens

OAuth authorization codes are single-use credentials with a deliberately short life: use it once, quickly, or lose it. The invalid_code error is the provider telling you the code is already spent or stale. In practice the cause is rarely the provider; it is the application's own plumbing. Retry logic that replays the token call, a frontend and backend that both try to exchange the same code, or a slow queue that holds the callback for minutes all burn the code before the real exchange happens. Because the error text does not say which of these happened, the fix starts with logging every exchange, which immediately reveals doubles and delays.

Edge cases / pitfalls

• PKCE flows add a second way to fail: a mismatched code verifier also surfaces as an invalid grant, so check the verifier too.
• Clock skew on the token call does not cause invalid_code, but it does cause neighboring errors; fix the clock separately.
• Some providers invalidate all outstanding codes when a new authorize starts; avoid parallel authorize attempts for one user.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstYQbninsxhcQg5l3r7A2aw

Resolved from the public thread: https://vectle.com/posts/pstYQbninsxhcQg5l3r7A2aw

Thread query: jira oauth error invalid_code grant type

TL;DR: An invalid_code almost always means the authorization code was already used or has expired. Log your token exchanges and confirm the code is exchanged exactly once, within its short lifetime, with a redirect URI byte-identical to the one registered. Then start a fresh authorize flow and exchange the new code promptly.

Not specified by the original author.

TL;DR

Looks like Box requires a correct Content-Type: application/x-www-form-urlencoded request header in addition to properly URL encoding the parameters. The same seems to apply to refresh and revoke requests.

The error

Invalid grant_type parameter or parameter missing

Fix

1. Looks like Box requires a correct Content-Type: application/x-www-form-urlencoded request header in addition to properly URL encoding the parameters. Expected: You get the expected result; the problem is gone.

2. The same seems to apply to refresh and revoke requests. Expected: You get the expected result; the problem is gone.

3. Also, per RFC 6749, the redirecturi is only REQUIRED, if the "redirecturi" parameter was included in the authorization request as described in Section 4.1.1, and their values MUST be identical. Expected: You get the expected result; the problem is gone.

4. Re-run the original operation and confirm the error is gone. Expected: no error, normal output.

When to use

• You hit this exact error with Box oauth2.
• The symptom matches: Invalid grant_type parameter or parameter missing.

When NOT to use

• A different error message from Box oauth2; the cause here is specific to this error.
• Unrelated Box oauth2 issues (different feature, different failure).
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported against Box oauth2 (mentions 4.1.1).

Variant phrasings

Invalid grant_type parameter or parameter missing

Why it happens

Stack Overflow question (score 11, has accepted answer): Exchanging the authorization code for tokens at the Box token endpoint keeps returning 400 "Invalid granttype parameter or parameter missing", even though granttype, code, clientid and clientsecret are all being posted as form fields.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• Behavior can change between releases; the linked source reflects the versions above.
• If the fix does not help, capture the full error output and check the source link for updates.

Stack Overflow question (score 11, has accepted answer): Exchanging the authorization code for tokens at the Box token endpoint keeps returning 400 "Invalid granttype parameter or parameter missing", even though granttype, code, clientid and clientsecret are all being posted as form fields. Resolved: Looks like Box requires a correct Content-Type: application/x-www-form-urlencoded request header in addition to properly URL encoding the parameters. The same seems to apply to refresh and revoke requests. Also, per RFC 6749, the redirecturi is only REQUIRED, if the "redirecturi" parameter was included in the authorization request as described in Section 4.1.1, and their values MUST be identical. Source: https://stackoverflow.com/questions/15269989/box-oauth2-invalid-grant-type-parameter-or-parameter-missing

Not specified by the original author.

Recover when the Zendesk OAuth refresh token is revoked

TL;DR

The stored refresh token was revoked - by the user, an admin, a password change, or the app being uninstalled - so every refresh attempt now fails with invalidgrant. Revocation is terminal: there is no way to un-revoke it. Send the user through the OAuth authorization flow again for a fresh token pair, and make the integration flip to a "needs re-auth" state on invalidgrant instead of retrying forever.

The error

POST https://YOUR-subdomain.zendesk.com/oauth/tokens -> 400
{"error":"invalid_grant","error_description":"The refresh token is revoked or invalid"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=zendesk%20oauth%20refresh%20token%20revoked%20error"

Fix it

Step 1: Confirm it is revocation, not a transient error

Attempt one refresh and log the exact error body. Retry once after a short wait to rule out a blip.

Expected: invalid_grant both times. A transient error would differ or clear; revocation is deterministic.

Step 2: Mark the stored token pair dead

In the integration's credential store, flag the Zendesk token pair as revoked so no worker keeps attempting refresh.

Expected: refresh attempts stop immediately. Every doomed refresh is wasted API traffic and log noise.

Step 3: Re-authorize through the OAuth flow

Direct the Zendesk admin to the app's authorize URL to grant access again.

Expected: a fresh authorization code. Only the account holder or admin can re-grant; the integration cannot do it alone.

Step 4: Exchange and store the new pair atomically

Exchange the code for the new access and refresh tokens and write both to the store in one transaction.

Expected: API calls succeed with the new access token. Atomic storage avoids half-written pairs.

Step 5: Handle invalid_grant as re-auth, not retry

In the token client, catch invalid_grant on refresh: set the integration state to needs-reauth, notify the admin, and stop retrying.

Expected: the next revocation pages a human with a clear action instead of burning retries silently.

When this applies

• Zendesk refresh returns invalid_grant consistently
• The integration worked before and suddenly lost auth
• A user or admin changed passwords or uninstalled the app

When it doesn't

• The access token expired but refresh works (normal rotation)
• The error is intermittent (network or Zendesk-side issue)
• The authorize step itself fails (app config problem)

Compatibility

Zendesk OAuth 2.0 authorization code flow, API v2. Applies to subdomain-scoped tokens.

Variant phrasings

zendesk invalid_grant refresh token

Confirm the grant type is refresh_token and the client credentials are correct before concluding revocation.

zendesk oauth token revoked reauthorize

Re-authorization is the only recovery. There is no refresh-of-a-revoked-token.

Why it happens

Refresh tokens are long-lived secrets that die on user or admin action: revoking the app's access, uninstalling, or changing the account password. The token endpoint cannot distinguish "revoked" from "never existed" and answers invalid_grant either way. Because the integration holds no other credential for that user, only a fresh interactive grant can restore access.

Edge cases

• Zendesk revokes tokens on password change; schedule re-auth comms around password policies
• Some configurations allow only one active refresh token per user and client; concurrent refreshes can kill each other
• The offline-access style scope is required to receive a refresh token at all; without it there is nothing to refresh

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pYkatfmrnBIPeFlwKgH8wg

Resolved from the public thread: https://vectle.com/posts/pst_pYkatfmrnBIPeFlwKgH8wg

Thread query: zendesk oauth refresh token revoked error

TL;DR: The stored refresh token was revoked - by the user, an admin, a password change, or the app being uninstalled - so every refresh attempt now fails with invalidgrant. Revocation is terminal: there is no way to un-revoke it. Send the user through the OAuth authorization flow again for a fresh token pair, and make the integration flip to a "needs re-auth" state on invalidgrant instead of retrying forever.