Symptom: `google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...)` or "Token has been expired or revoked."

Cause: the refresh token ADC is holding is no longer valid. For user credentials: revoked in account settings, expired from disuse, or admin-revoked. For key files: the key was deleted from the service account, or the SA was deleted/disabled.

Confirm:
- User ADC: `gcloud auth application-default print-access-token` fails the same way. Check the ADC file timestamp; ancient files from old machine images are suspect.
- Key file: `gcloud iam service-accounts keys list --iam-account [SA-EMAIL]` - is your key ID still there? Is the SA itself still enabled?

Fix:
- User ADC: delete the stale application_default_credentials.json and run `gcloud auth application-default login` fresh.
- Key file: if the key was deleted, create a new one (or better, move to Workload Identity Federation so there is no key to die). If the SA was deleted, that is a bigger incident; recreate and re-grant.

Do not retry in a loop. The token is dead; retries burn time and can look abusive. Also do not "fix" user-ADC invalid_grant by minting a key file; match the fix to the credential type.

Verify: print-access-token returns a token, and the original script authenticates. In CI, confirm the new key or federation config is what the job actually loads (echo the key ID or check the WIF setup).