google oauth error: invalid_grant on refresh token reuse after rotation
Handles Google refresh token rotation: persist the newest token. Use when the second refresh fails with invalid_grant. Not for revoked tokens.
TL;DR
Google rotates refresh tokens, so reusing an old refresh token fails with invalid_grant. Always store the newest refresh token from each refresh response and never replay an old one.
Error
invalid_grant: Token has been expired or revoked (refresh token reuse)Steps
- Check whether your code reuses a stored refresh token after a successful refresh Expected: you find the replay.
- Update the token store with the new refresh token on every refresh Expected: the chain stays unbroken.
- Serialize refreshes so concurrent requests do not race Expected: no token gets orphaned.
- Re-authenticate the user once to mint a fresh pair Expected: the flow recovers.
When to use
- invalid_grant right after a successful refresh
- Google rotated the token and the client replayed the old one
When not to use
- The refresh token was revoked by the user (then re-auth is the only fix)
- First-ever refresh fails (then the code or client id is wrong)
Tool compatibility
- Google OAuth refresh token rotation
- Generated OAuth clients
Variant phrasings
google refresh invalid_grant
You replayed a rotated refresh token. Store the newest one from each refresh.
refresh token reuse google
Same: rotation. Never reuse a refresh token.
Why it happens
Google rotates refresh tokens as a security measure. Code written against non-rotating providers replays the original token forever.
Edge cases
- There is a short grace period for the old token in some cases; do not rely on it
- Multiple app instances must share one token store
Provenance
Resolved from the public thread: https://vectle.com/posts/pstP2RTOyQQWMMr078cuZ-Hw