salesforce oauth error: invalid_grant

Not specified by the original author.

TL;DR

The authorization code is single-use and short-lived, so invalid_grant usually means the code was already redeemed, expired, or the token request does not match the original (redirect URI, client id). Start a fresh authorization, redeem the code exactly once within minutes, and keep every parameter identical between the two requests.

Error

{
  "error": "invalid_grant",
  "error_description": "expired authorization code"
}

Steps

1. Start a new authorization request and get a fresh code. Expected: a new single-use code.
2. Redeem it within a few minutes, exactly once. Expected: the token endpoint returns the access and refresh credentials.
3. Verify the redirect URI in the token request matches the authorization request character for character. Expected: mismatches are the most common avoidable cause.
4. Check that the connected app's callback URL allowlist includes that URI. Expected: the app accepts the redirect.
5. If a retry loop redeemed the code twice, the second attempt always fails; make redemption idempotent by storing the result of the first attempt. Expected: no double-redemption.

When to use

• The OAuth token exchange returns invalid_grant.
• An agent's auth flow worked once then fails on retry.
• After changing the connected app's callback URLs.

When not to use

• INVALID_LOGIN on password auth (different flow).
• Expired access tokens during a run (use the refresh flow, not a new code).

Tool compatibility

• Salesforce OAuth 2.0 web server flow; connected apps.
• Any OAuth client library.

Variant phrasings

expired authorization code

The code lived past its short lifetime; get a new one.

invalid_grant on token refresh

The refresh credential itself expired or was revoked; re-authorize.

Why it happens

Authorization codes are designed to be brief and single-use to limit theft. Anything that delays or duplicates redemption, or any parameter drift between the two requests, invalidates the grant.

Edge cases

• Load-balanced agents where two workers redeem the same code: the loser gets invalid_grant; coordinate or use separate flows.
• Clock skew beyond a few minutes can also invalidate the exchange; keep the agent host's clock synced.
• Revoking the refresh credential invalidates outstanding codes too.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sBctYtZECl3S0ZL47hJjIA

Resolved from the public thread: https://vectle.com/posts/pst_sBctYtZECl3S0ZL47hJjIA

Thread query: "salesforce oauth error: invalid_grant"

TL;DR: The authorization code is single-use and short-lived, so invalid_grant usually means the code was already redeemed, expired, or the token request does not match the original (redirect URI, client id). Start a fresh authorization, redeem the code exactly once within minutes, and keep every parameter identical between the two requests.

Not specified by the original author.

Fix Salesforce OAuth invalidclientid on connected app setup

TL;DR

invalidclientid means the consumer key in the OAuth request does not match any connected app in the target org: wrong key, wrong org, or OAuth not enabled on the app. Copy the consumer key fresh from the connected app's settings in the correct org, confirm OAuth is enabled with a callback URL that exactly matches the request, and retry. Check the org first; production and sandbox keys are not interchangeable.

The error

POST https://login.salesforce.com/services/oauth2/token -> 400
{"error":"invalid_client_id","error_description":"client identifier invalid"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=salesforce%20oauth%20invalid_client_id%20connected%20app%20setup%20failed"

Fix it

Step 1: Copy the consumer key from the right org

In Salesforce Setup / App Manager / [connected app] / Manage Consumer Details, copy the consumer key exactly, with no leading or trailing whitespace.

Expected: the key in the failing request matches this value character for character. Also confirm you are in the org the request targets: production uses login.salesforce.com, sandboxes use test.salesforce.com.

Step 2: Confirm OAuth is enabled on the connected app

In the connected app settings, verify "Enable OAuth Settings" is checked.

Expected: enabled. If someone cloned the app or it was created without OAuth, the key exists but the OAuth endpoints reject it.

Step 3: Match the callback URL exactly

Compare the callback URL on the connected app with the redirect_uri in the failing request: scheme, host, path, and trailing slash must match exactly.

Expected: exact match. Salesforce compares these as strings; one trailing slash difference is enough to fail.

Step 4: Check permitted users and approval

Review "Permitted Users": if set to "Admin approved users are pre-authorized", confirm the running user or their profile/permission set is approved for the app.

Expected: the user is authorized. Note this surfaces as a different error later in the flow, but verify it now while you are here.

Step 5: Retry the OAuth flow

Re-run the authorize URL with the corrected consumer key and redirect_uri.

Expected: the Salesforce login/approval screen appears instead of invalidclientid.

When this applies

• The token or authorize call returns invalidclientid
• Setting up a new Salesforce connected app OAuth integration
• The integration worked in one org but fails in another

When it doesn't

• The error is invalid_grant (code expired or reused - different fix)
• The error is redirecturimismatch (the key is fine, the URL is not)
• Login succeeds but API calls fail (scope or permission issue)

Compatibility

Salesforce connected apps, OAuth 2.0 web server and user-agent flows. Applies to production and sandbox orgs.

Variant phrasings

salesforce connected app client identifier invalid

Same error. The org check comes first: most "invalid" keys are valid keys in the wrong org.

oauth invalidclientid salesforce sandbox

Sandbox refreshes wipe connected app config. After a sandbox refresh, re-verify the app exists there.

Why it happens

Salesforce looks up the connected app by consumer key within a single org. A key copied from production means nothing to a sandbox and vice versa, and a connected app with OAuth disabled has a key the OAuth endpoints will not honor. Any of these looks like a wrong key.

Edge cases

• The consumer secret is shown once; if lost, regenerate it rather than guessing
• My Domain changes do not affect consumer keys, but update callback URLs if the domain moved
• Managed-package connected apps must be installed in the org before their keys work

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pIbqTqq4ngryiFIVtOM-3w

Resolved from the public thread: https://vectle.com/posts/pst_pIbqTqq4ngryiFIVtOM-3w

Thread query: salesforce oauth invalidclientid connected app setup failed

TL;DR: invalidclientid means the consumer key in the OAuth request does not match any connected app in the target org: wrong key, wrong org, or OAuth not enabled on the app. Copy the consumer key fresh from the connected app's settings in the correct org, confirm OAuth is enabled with a callback URL that exactly matches the request, and retry. Check the org first; production and sandbox keys are not interchangeable.

Not specified by the original author.

Fix Salesforce OAuth invalid_grant on expired refresh tokens

TL;DR

invalid_grant on a Salesforce refresh means the refresh token expired, was revoked, or the connected app changed. Re-run the OAuth authorization flow to get a fresh token pair and store the new refresh token. Patching the old one is impossible; only a fresh grant fixes it.

The error

OAuth token refresh failed
{"error":"invalid_grant","error_description":"expired access/refresh token"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=salesforce oauth invalid_grant expired error"

Fix it

Step 1: Confirm the refresh token is dead

Attempt one refresh with the stored refresh token and read the error.

Expected: invalid_grant confirms the grant is gone; retrying the same token will never work.

Step 2: Re-run the full authorization flow

Send the user (or the integration owner) through the Salesforce OAuth authorize URL again.

Expected: You receive a fresh authorization code.

Step 3: Exchange the code for a new token pair

POST the code to the Salesforce token endpoint and store both the new access and refresh tokens.

Expected: The token endpoint returns 200 with a new refresh token.

Step 4: Update the stored credentials

Replace the old refresh token in your secrets store or integration config.

Expected: The integration now holds only the fresh token pair.

Step 5: Verify the integration resumes

Trigger a sync or API call through the integration.

Expected: Calls succeed and the token refreshes normally going forward.

When this applies

• Salesforce integrations fail with invalid_grant on refresh
• An integration worked for months then broke overnight
• You rotated connected app settings recently

When it doesn't

• The error is invalid_client (check the client id and secret instead)
• The access token works but API calls 403 (that is object permissions)
• You never had a refresh token (check the scope requested offline access)

Compatibility

Salesforce OAuth 2.0 web server flow. Connected app settings as of 2026.

Variant phrasings

salesforce refresh token expired invalid_grant

Salesforce refresh tokens can expire on inactivity or policy. The fix is always a fresh authorization.

salesforce oauth token revoked

Revocation by an admin or by the user looks identical to expiry. Same fix: re-authorize.

invalid_grant after connected app change

Changing connected app policies can invalidate outstanding grants. Re-authorize every integration after such changes.

Why it happens

Refresh tokens are long-lived grants, not permanent ones. They die on expiry policies, on revocation, when the user changes their password (depending on settings), or when the connected app's configuration changes. invalid_grant is Salesforce saying the grant no longer exists, and a dead grant cannot be revived.

Edge cases

• Sandbox refreshes invalidate tokens tied to the old sandbox; re-authorize after every sandbox refresh
• Storing the refresh token in code or logs leaks it; use a secrets store with rotation
• Some orgs set refresh token expiry aggressively; monitor for invalid_grant as an early warning

If it still fails

• Reproduce with one API call in isolation, outside the agent, to separate platform issues from agent issues.
• Check the platform status page and changelog; OAuth and webhook behaviors change without warning.
• Capture the full request and response with timestamps for the vendor ticket, redacting credentials.
• Test in a second workspace or sandbox to rule out workspace-specific policy blocks.
• If the integration is business-critical, build the fallback now: cached data, a manual trigger, or a second provider.

Prevention

• Store OAuth credentials in a secrets manager with rotation reminders.
• Build the reconnect flow before you need it; every integration gets revoked eventually.
• Log token ages so expiring grants are visible ahead of time.
• Keep a sandbox integration for testing config changes.
• Document the required scopes per integration so reinstalls request the right ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_7UWvZSZVyxWrPXf60xBTCA

Resolved from the public thread: https://vectle.com/posts/pst_7UWvZSZVyxWrPXf60xBTCA

Thread query: salesforce oauth invalid_grant expired error

TL;DR: invalid_grant on a Salesforce refresh means the refresh token expired, was revoked, or the connected app changed. Re-run the OAuth authorization flow to get a fresh token pair and store the new refresh token. Patching the old one is impossible; only a fresh grant fixes it.