# confluence oauth refresh failed revoked token error

## TL;DR
A failed refresh with an invalid grant means the stored refresh token is dead: the user revoked it in their Atlassian account or it aged out. Stop retrying the refresh, mark the stored tokens dead, and send the user through the OAuth authorize flow again. Store the new token pair and add monitoring so the next revocation surfaces as a re-auth prompt instead of a broken integration.

```text
confluence oauth refresh failed revoked token error
```

## Use this when

- A Confluence integration breaks months after setup with a refresh failure
- The token endpoint returns invalid_grant on the refresh call
- The user recently changed their Atlassian security settings

## Not for this skill when

- The very first authorization never succeeded (fix the authorize flow)
- API calls fail with 403 on a valid token (permissions, not tokens)
- Access tokens expiring normally while refresh still works (expected behavior)

## Steps

### Step 1: Stop the refresh loop

Catch the invalid_grant on refresh and halt retries immediately; a dead refresh token never comes back to life. Expected: no more doomed refresh attempts in the logs.

### Step 2: Mark the tokens dead

Flag the stored access and refresh tokens as revoked in your database so no worker keeps using them. Expected: the integration shows a clean needs-reauth state instead of flapping.

### Step 3: Re-run the authorize flow

Redirect the user through the full OAuth authorize flow to grant access again. Expected: the callback delivers a fresh authorization code.

### Step 4: Store the new pair and rotate

Exchange the code and persist the new access and refresh tokens, discarding the old ones everywhere including caches. Expected: API calls succeed with the new access token.

### Step 5: Add revocation monitoring

Alert on refresh invalid_grant so the team knows a user revoked access, and surface a reconnect prompt in the product. Expected: the next revocation becomes a one-click fix, not an incident.

## Tool compatibility

Confluence Cloud OAuth 2.0 (3LO); Atlassian account connected-apps settings; token storage in the integrating application.

## Variant phrasings

### Variant 1

confluence oauth refresh token revoked invalid_grant

### Variant 2

confluence integration refresh failed user revoked access

### Variant 3

atlassian oauth refresh token expired reconnect

## Why it happens

Refresh tokens are long-lived but not immortal: users can revoke them from their Atlassian security settings, and providers expire them after long inactivity. When that happens the refresh call fails with invalid_grant, and integrations without a re-auth path sit broken indefinitely because every subsequent refresh fails identically. The deeper issue is state management: the application keeps treating dead tokens as merely stale and retries forever. Treating invalid_grant on refresh as a terminal state that flips the integration into needs-reauth turns a silent outage into a routine reconnect.

## Edge cases / pitfalls

- Multiple installs of the same app by one user create multiple token pairs; revoking one breaks only its integration.
- Refresh token rotation races (two workers refreshing at once) can kill a good token; serialize refreshes.
- Service accounts owned by a departed employee get revoked at offboarding; prefer a service identity that survives turnover.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Uvl59e2rouhrxpHcyzMwOg