invalid_grant: token has been expired or revoked

invalid_grant: token has been expired or revoked

TL;DR

The OAuth provider is telling you the grant behind your refresh token is dead: it expired, or something revoked it. Do not retry the dead token in a loop. Figure out which one it was (expired by age, or revoked by a password change, admin action, or rotation reuse), then send the user through the authorization flow once to get a fresh token pair, and make your client handle rotation properly going forward.

invalid_grant: token has been expired or revoked

Use this when

• Refresh-token requests start failing with invalid_grant
• It broke right after a password change, admin revoke, or provider settings change
• Stored tokens that worked for weeks suddenly stop
• One user or one integration fails while others keep working

Not for this skill when

• The failure is on the initial code exchange ("malformed auth code" is a different problem)
• The user never consented (consent errors come first)
• The redirect URI mismatches (that fails earlier with its own error)

Steps

1. Determine expired versus revoked. Check the token's age against the provider's refresh-token lifetime (commonly 14 days sliding, sometimes shorter). If the token is older than the lifetime, it expired naturally. If it is young, something revoked it.

Expected: you know which of the two you are dealing with before changing anything.

1. Hunt the revocation trigger. The usual suspects: the user changed their password, an admin revoked sessions or the app grant, the provider detected refresh-token rotation reuse (it treats reuse as theft and kills the whole grant), or too many concurrent sessions pushed the oldest out.

Expected: server or provider logs show the revoking event, or you can reproduce it (change password, watch the grant die).

1. Re-authorize cleanly. Send the user through the authorization flow once to mint a fresh access and refresh pair. Do not keep retrying the dead refresh token; providers rate-limit that and it never succeeds.

Expected: the token endpoint returns 200 with a new pair, and API calls work again.

1. Fix the client so it survives rotation. Store the refresh token durably, replace the stored value with the new one on every refresh (rotated tokens are single-use), and treat invalid_grant as "re-authenticate" rather than "retry harder". Back off instead of hammering the token endpoint.

Expected: the next natural expiry or rotation is handled without user-visible breakage.

Variant: rotation reuse flagged as theft

Many providers revoke the entire grant when a refresh token is used twice, assuming token theft. Concurrent refreshes racing each other are the classic false positive. Serialize refreshes with a lock or a single-flight mechanism.

Variant: invalid_grant on first use of a fresh token

The token was likely never valid: wrong client credentials, wrong token endpoint (staging vs prod), or the grant was issued for a different client. Check the basics before suspecting expiry.

Variant: "offline_access" scope missing, so no refresh token at all

Some clients fail later with invalid_grant-shaped confusion because they never received a refresh token in the first place. Confirm the original authorization requested offline access and that the provider honored it.

Variant: works after re-auth, then dies again quickly

Something is actively revoking grants: a security policy, a session limit, or another client instance refreshing with the same stored token and triggering reuse detection. Find the second actor.

Why this happens

invalid_grant is the provider's way of saying "the permission slip you are presenting no longer exists." Refresh tokens die two ways: they age out past their lifetime, or an event (password change, admin revoke, suspected theft via rotation reuse) kills them early. Either way the grant is gone and only a fresh authorization creates a new one.

Edge cases and pitfalls

• Clock skew can make a live token look expired to one party. Rule this out before assuming revocation, especially across data centers.
• Test and production providers have separate token stores. A refresh token minted against staging is invalid_grant against production by design.
• Logging refresh tokens while debugging this leaks long-lived credentials. Log token age and grant IDs, never the token.
• Some providers do not distinguish expired from revoked in the error. Your investigation has to, because the fixes differ (longer lifetimes vs finding the revoking event).

Provenance

Resolved from the public thread: https://vectle.com/posts/pstW6FdlURvFw9Sgu2luPXIg