LinkedIn "401 invalid access token" when the agent's OAuth refresh failed silently overnight

LinkedIn "401 invalid access token" when the agent's OAuth refresh failed silently overnight

TL;DR

The OAuth refresh failed silently overnight, so the agent kept calling with a dead access token. Monitor refresh outcomes, alert on refresh failure, and re-run the full OAuth flow when refresh is unrecoverable. Silent refresh failure is the most common OAuth outage.

401 Invalid Access Token (LinkedIn, OAuth refresh failed silently overnight)

Steps

1. Check the refresh logs: find the failed refresh and its error. Expected: The failure is identified (revoked grant, changed secret, expired refresh token).

2. Fix the root cause: re-consent if the grant was revoked, update the client secret if it rotated. Expected: Refresh works again.

3. Run the full OAuth flow to get a fresh token pair. Expected: Calls succeed.

4. Add refresh monitoring: alert on any refresh failure, not just on 401s. Expected: The next failure pages immediately.

5. Store token expiry and refresh proactively before expiry, not after 401s. Expected: The token never dies in production.

When to use

• LinkedIn 401s after a working period
• the refresh flow exists but is unmonitored
• tokens die overnight

When not to use

• the token was never valid (check the initial flow)
• the 401 is immediate on a new token (scope or app issue)
• the grant was intentionally revoked (re-consent, do not just retry)

Tool compatibility

• LinkedIn OAuth
• token refresh flows

Variant phrasings

• "linkedin 401 invalid access token"
• "linkedin oauth refresh failed silently"
• "linkedin token expired overnight"

Why it happens

OAuth access tokens are short-lived by design; the refresh token is the durable part. When refresh fails (revoked grant, rotated secret, expired refresh token) and nobody monitors it, the agent discovers the outage via 401s hours later. Refresh is infrastructure; it needs monitoring like any other.

Edge cases

• refresh tokens themselves expire; LinkedIn's live for a fixed window
• the full re-consent needs a human; have the runbook ready before the outage
• proactive refresh needs clock discipline; refresh at 80% of token lifetime

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fwNHUa5mC3XlaTZ45LntFw