Miro tokenExpired 401: refresh once, then reauthorize, never loop the refresh

Miro tokenExpired 401: refresh once, then reauthorize, never loop the refresh

TL;DR

Context: Miro troubleshooting OAuth2.0: tokenExpired 401 causes and when you must reauthorize Miro's OAuth troubleshooting guide lists the tokenExpired 401 causes: no access token in the Authorization header, a bad token, or an expired one. For expiring tokens, access tokens die after 3599 seconds. The refresh token is also one-use: using it to mint a new access token invalidates it.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Miro 401 tokenExpired is not always a refresh problem A 401 with code tokenExpired from Miro has three possible causes and only two of them are fixable with a refresh: 1. No access token was passed in the Authorization header. 2. The token is invalid (typo, wrong string, whatever). 3. The token genuinely expired: 3599 seconds for expiring-token apps. Two more edges the troubleshooting guide calls out: - A new access token kills the old pair. If two workers race to refresh, the loser's tokens are dead and every later call from that worker 401s. - If the token expired and it has been more than 60 minutes since a refresh was possible, refreshing does not work. You have to reauthorize the user from scratch. So the retry ladder is: attach the token properly, refresh once, and if the refresh fails, do not loop on refresh: kick off the full OAuth authorization flow. Looping refresh calls against a dead refresh token is how a quick blip turns into a stuck integration.

And if more than 60 minutes have passed since the last refresh and the token already expired, you do not get to refresh: you must send the user through authorization again.

Source: Miro troubleshooting OAuth2.0: tokenExpired 401 causes and when you must reauthorize Miro's OAuth troubleshooting guide lists the tokenExpired 401 causes: no access token in the Authorization header, a bad token, or an expired one. For expiring tokens, access tokens die after 3599 seconds. The refresh token is also one-use: using it to mint a new access token invalidates it. And if more than 60 minutes have passed since the last refresh and the token already expired, you do not get to refresh: you must send the user through authorization again.

Verified resolution: # Miro 401 tokenExpired is not always a refresh problem A 401 with code tokenExpired from Miro has three possible causes and only two of them are fixable with a refresh: 1. No access token was passed in the Authorization header. 2. The token is invalid (typo, wrong string, whatever). 3. The token genuinely expired: 3599 seconds for expiring-token apps. Two more edges the troubleshooting guide calls out: - A new access token kills the old pair. If two workers race to refresh, the loser's tokens are dead and every later call from that worker 401s. - If the token expired and it has been more than 60 minutes since a refresh was possible, refreshing does not work. You have to reauthorize the user from scratch. So the retry ladder is: attach the token properly, refresh once, and if the refresh fails, do not loop on refresh: kick off the full OAuth authorization flow. Looping refresh calls against a dead refresh token is how a quick blip turns into a stuck integration.

Source URL: https://developers.miro.com/docs/troubleshooting-oauth20