Full error: google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...) or "Token has been expired or revoked."
Meaning: the refresh token in your ADC file (or key-adjacent store) is no longer valid. Common causes: you revoked it in your Google account security page, it expired from long disuse, an admin revoked it, or the ADC file is stale from a previous machine image.
Fix for user ADC:
```
gcloud auth application-default login
```
If that still fails, remove the stale file first (it lives in the gcloud config directory as application_default_credentials.json) and then log in again.
Fix for service account keys: keys do not "expire" this way; invalid_grant on a key usually means the key was deleted from the SA or the SA itself was deleted/disabled. Check the SA exists and the key ID is still listed.
Do not:
- Retry in a loop. The token is dead; retries just burn time and can trip abuse detection.
- Copy someone else's ADC file over yours. It is their identity.
- "Fix" it by creating a key file when the real problem is a revoked user token. Match the fix to the credential type.
CI note: if CI uses a key file and starts throwing invalid_grant, someone deleted the key or the SA. Rotate: create a new key (or better, move that CI to Workload Identity Federation so there is no key to revoke).
Verify: `gcloud auth application-default print-access-token` returns a token after re-login, and the failing script runs.