TL;DR: After you rotate the app key in Dropbox Sign, every stored secret and every in-flight authorization code tied to the old one is dead. Update the secret in your integration to the new value, then run the OAuth flow again to mint a fresh authorization code - codes expire in minutes and are single-use, so do not reuse the old one.

```text
invalid_grant
```

1. Open your Dropbox Sign API app settings and confirm which key is current.
   Expected: the key your integration stores does not match - that is the break.
2. Copy the new secret into your integration's config and reload or restart the service so it picks it up.
   Expected: no cached old secret remains in env or secret store.
3. Run the OAuth authorization flow again to get a brand-new code, and exchange it immediately.
   Expected: the token endpoint returns 200 with an access token instead of invalid_grant.
4. Verify a full cycle: create a test signature request with the new token.
   Expected: success, no auth errors.
5. Remove references to the old key so the next rotation does not repeat this.

## Use this when
- token exchange or refresh fails with invalid_grant right after a key rotation
- it worked yesterday and the only change was the rotation
- you are seeing invalid_grant on a fresh integration (wrong secret pasted)

## Not for this skill when
- the error is invalid_client (wrong client ID rather than secret or code)
- the redirect URL mismatches what is registered (fix the registered redirect URL instead)
- the token works but API calls return 401 (check scopes and token expiry)

## Variant phrasings
### dropbox sign invalid_grant token exchange
### hellosign invalid_grant after api key rotation
### dropbox sign oauth invalid_grant on refresh

## Why it happens
The token endpoint validates the client secret on every exchange. Rotating the key in the dashboard instantly invalidates the old secret, and authorization codes are short-lived and single-use, so anything minted before the rotation - or exchanged late - fails with invalid_grant rather than a more specific message.

## Edge cases
- Test vs production keys: rotating one does not affect the other; make sure you updated the right environment.
- Codes expire in minutes; if your flow has a human approval step, the code may die before exchange - automate or shorten the gap.
- Clock skew between your server and Dropbox Sign can also produce grant errors; check NTP if the secret is definitely right.
- Some SDKs cache the token response; clear the cache after rotation.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZS_d9LZqHTbqrXQvlN3JJA