# mailchimp oauth2 token endpoint 400 invalid grant error

## TL;DR
The code is expired, already used, or the client credentials are wrong. Start a fresh authorize flow, exchange the new code exactly once and immediately at Mailchimp's token endpoint with correct client credentials, and confirm you get tokens back. Note the datacenter prefix in the response metadata for subsequent API calls.

```text
mailchimp oauth2 token endpoint 400 invalid grant error
```

## Use this when

- Mailchimp OAuth token call returns 400 invalid grant
- The integration fails right after the user authorizes
- Retry logic seems to make it worse

## Not for this skill when

- invalid_client errors (the client ID or secret is wrong)
- API key integrations failing (no OAuth involved)
- Rate limiting on the token endpoint (a 429, not a 400)

## Steps

### Step 1: Start a fresh authorize flow

Send the user through the Mailchimp authorize URL again. Expected: a brand-new authorization code arrives at your callback; the old one is dead.

### Step 2: Exchange exactly once, immediately

Exchange the fresh code a single time right away. Expected: one token request per code, no retries on invalid grant.

### Step 3: Verify the token endpoint and credentials

Confirm you are calling Mailchimp's OAuth token endpoint with the correct client ID and secret for this app. Expected: the endpoint and credentials match the app's Mailchimp developer settings.

### Step 4: Confirm the token response

Check that the response includes an access token and note the datacenter metadata. Expected: a usable access token, not another error.

### Step 5: Use the datacenter for API calls

Direct subsequent API calls at the datacenter-specific API host from the token metadata. Expected: API calls succeed instead of hitting the wrong datacenter.

## Tool compatibility

Mailchimp Marketing API OAuth 2.0; Mailchimp developer app settings; OAuth token endpoint clients.

## Variant phrasings

### Variant 1

mailchimp oauth2 invalid_grant token exchange failed

### Variant 2

mailchimp oauth 400 bad request token endpoint

### Variant 3

mailchimp authorization code invalid grant fix

## Why it happens

Mailchimp's invalid_grant at the token endpoint covers the usual suspects, expired or reused codes and bad client authentication, in one unhelpful code. The codes are short-lived, so any delay between the callback and the exchange, a queue, a slow serverless cold start, or a human pausing mid-flow, burns the code. Retry logic then makes it worse by exchanging the same dead code again. The reliable pattern is the boring one: fresh authorize, immediate single exchange, correct credentials, and only then worry about the API calls themselves.

## Edge cases / pitfalls

- Do not call the datacenter API host for the token exchange; the token endpoint is separate.
- Serverless cold starts can push the exchange past the code lifetime; exchange synchronously in the callback handler.
- Log the token request timing; if authorize-to-exchange regularly exceeds a minute, fix the latency, not the code.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IBj1ii6SB1nRK9k_0fUjJw