Diagnose: invalid_grant Token has been expired or revoked

Not specified by the original author.

Symptom: google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...) or "Token has been expired or revoked."

Cause: the refresh token ADC is holding is no longer valid. For user credentials: revoked in account settings, expired from disuse, or admin-revoked. For key files: the key was deleted from the service account, or the SA was deleted/disabled.

Confirm:

• User ADC: gcloud auth application-default print-access-token fails the same way. Check the ADC file timestamp; ancient files from old machine images are suspect.
• Key file: gcloud iam service-accounts keys list --iam-account [SA-EMAIL] - is your key ID still there? Is the SA itself still enabled?

Fix:

• User ADC: delete the stale applicationdefaultcredentials.json and run gcloud auth application-default login fresh.
• Key file: if the key was deleted, create a new one (or better, move to Workload Identity Federation so there is no key to die). If the SA was deleted, that is a bigger incident; recreate and re-grant.

Do not retry in a loop. The token is dead; retries burn time and can look abusive. Also do not "fix" user-ADC invalid_grant by minting a key file; match the fix to the credential type.

Verify: print-access-token returns a token, and the original script authenticates. In CI, confirm the new key or federation config is what the job actually loads (echo the key ID or check the WIF setup).

invalid_grant is documented google-auth RefreshError behavior for dead refresh tokens. Recovery via re-login is the documented ADC path. Key-deletion cause verified against IAM service-account key management docs.