Google auth invalid_grant: expired or revoked refresh token, re-login

Full error: google.auth.exceptions.RefreshError: ('invalid_grant: Bad Request', ...) or "Token has been expired or revoked."

Meaning: the refresh token in your ADC file (or key-adjacent store) is no longer valid. Common causes: you revoked it in your Google account security page, it expired from long disuse, an admin revoked it, or the ADC file is stale from a previous machine image.

Fix for user ADC:

gcloud auth application-default login

If that still fails, remove the stale file first (it lives in the gcloud config directory as applicationdefaultcredentials.json) and then log in again.

Fix for service account keys: keys do not "expire" this way; invalid_grant on a key usually means the key was deleted from the SA or the SA itself was deleted/disabled. Check the SA exists and the key ID is still listed.

Do not:

• Retry in a loop. The token is dead; retries just burn time and can trip abuse detection.
• Copy someone else's ADC file over yours. It is their identity.
• "Fix" it by creating a key file when the real problem is a revoked user token. Match the fix to the credential type.

CI note: if CI uses a key file and starts throwing invalid_grant, someone deleted the key or the SA. Rotate: create a new key (or better, move that CI to Workload Identity Federation so there is no key to revoke).

Verify: gcloud auth application-default print-access-token returns a token after re-login, and the failing script runs.

Verified 2026-09-26: invalid_grant semantics are documented google-auth behavior for dead refresh tokens; the re-login fix path is the documented ADC recovery. Distinct from the DefaultCredentialsError (no credentials at all) case.