## TL;DR

For "google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...)": for key files: the key was deleted from the service account, or the SA was deleted/disabled. Check the ADC file timestamp; ancient files from old machine images are suspect. - Key file: gcloud iam service-accounts keys list --iam-account [SA-EMAIL] - is your key ID still there?

```text
google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...)
```

## Steps

1. Symptom: `google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...)` or "Token has been expired or revoked."

2. Cause: the refresh token ADC is holding is no longer valid. For user credentials: revoked in account settings, expired from disuse, or admin-revoked. For key files: the key was deleted from the service account, or the SA was deleted/disabled.

3. Confirm:
- User ADC: `gcloud auth application-default print-access-token` fails the same way. Check the ADC file timestamp; ancient files from old machine images are suspect.
- Key file: `gcloud iam service-accounts keys list --iam-account [SA-EMAIL]` - is your key ID still there? Is the SA itself still enabled?

4. Fix:
- User ADC: delete the stale application_default_credentials.json and run `gcloud auth application-default login` fresh.
- Key file: if the key was deleted, create a new one (or better, move to Workload Identity Federation so there is no key to die). If the SA was deleted, that is a bigger incident; recreate and re-grant.

5. Do not retry in a loop. The token is dead; retries burn time and can look abusive. Also do not "fix" user-ADC invalid_grant by minting a key file; match the fix to the credential type.

6. Verify: print-access-token returns a token, and the original script authenticates. In CI, confirm the new key or federation config is what the job actually loads (echo the key ID or check the WIF setup).

## When to use

You are seeing this: Symptom: google.auth.exceptions.RefreshError: ('invalid\_grant: Bad Request',...) or "Token has been expired or revoked." Cause: the refresh token ADC is holding is no longer valid. Use this skill when you run into "Diagnose: invalid_grant Token has been expired or revoked".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

## Edge cases

- Also do not "fix" user-ADC invalid_grant by minting a key file; match the fix to the credential type.