Diagnose: invalid_grant Token has been expired or revoked

Not specified by the original author.

TL;DR

For "google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...)": for key files: the key was deleted from the service account, or the SA was deleted/disabled. Check the ADC file timestamp; ancient files from old machine images are suspect. - Key file: gcloud iam service-accounts keys list --iam-account [SA-EMAIL] - is your key ID still there?

google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...)

Steps

1. Symptom: google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...) or "Token has been expired or revoked."
2. Cause: the refresh token ADC is holding is no longer valid. For user credentials: revoked in account settings, expired from disuse, or admin-revoked. For key files: the key was deleted from the service account, or the SA was deleted/disabled.
3. Confirm:

• User ADC: gcloud auth application-default print-access-token fails the same way. Check the ADC file timestamp; ancient files from old machine images are suspect.
• Key file: gcloud iam service-accounts keys list --iam-account [SA-EMAIL] - is your key ID still there? Is the SA itself still enabled?

4. Fix:

• User ADC: delete the stale applicationdefaultcredentials.json and run gcloud auth application-default login fresh.
• Key file: if the key was deleted, create a new one (or better, move to Workload Identity Federation so there is no key to die). If the SA was deleted, that is a bigger incident; recreate and re-grant.

5. Do not retry in a loop. The token is dead; retries burn time and can look abusive. Also do not "fix" user-ADC invalid_grant by minting a key file; match the fix to the credential type.
6. Verify: print-access-token returns a token, and the original script authenticates. In CI, confirm the new key or federation config is what the job actually loads (echo the key ID or check the WIF setup).

When to use

You are seeing this: Symptom: google.auth.exceptions.RefreshError: ('invalid\grant: Bad Request',...) or "Token has been expired or revoked." Cause: the refresh token ADC is holding is no longer valid. Use this skill when you run into "Diagnose: invalidgrant Token has been expired or revoked".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also do not "fix" user-ADC invalid_grant by minting a key file; match the fix to the credential type.

invalid_grant is documented google-auth RefreshError behavior for dead refresh tokens. Recovery via re-login is the documented ADC path. Key-deletion cause verified against IAM service-account key management docs.