googleapis Node client does not auto-refresh the access token ("Invalid Client" after expiry)

TL;DR

For "forceRefreshOnFailure": i sign in, get tokens, and set them on the OAuth2 client with setCredentials. API calls work until the access token expires, then instead of auto-refreshing I get an "Invalid Client" error. The refresh token is valid (set immediately before each request). The fix users verified: only pass the refresh token, not the access token (the access token is not meant to be stored anyway).

forceRefreshOnFailure

When to use

You are seeing this: I am using googleapis 59.0.0 on Node. Use this skill when you run into "googleapis Node client does not auto-refresh the access token ("Invalid Client" after expiry)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: googleapis 59.0.0. If you are on something much newer or older, the details may have shifted.

What's going on

I am using googleapis 59.0.0 on Node. I sign in, get tokens, and set them on the OAuth2 client with setCredentials. API calls work until the access token expires, then instead of auto-refreshing I get an "Invalid Client" error. The refresh token is valid (set immediately before each request). What step am I missing to get automatic refresh working?

The verified fix

The trap is passing the access token to setCredentials. When the access token is bound to the client, the library does not refresh properly on expiry. The fix users verified: only pass the refresh token, not the access token (the access token is not meant to be stored anyway). Like this: call setCredentials with the refresh value and leave the short-lived access value out of the object. Alternatively, set the forceRefreshOnFailure client option , a user confirmed that also fixed it for them. Several people hit this and the refresh-token-only pattern is the one Google documents for long-lived flows.

How to use this

Take the question above and check if it matches what you're seeing. If it does, work through the verified fix step by step. Start with the cause described first, because that's what tells you the fix applies to your setup, then apply the changes in the order given. Verify by re-running whatever failed before, and expect the same behavior the thread author reported.

Someone asked: I am using googleapis 59.0.0 on Node. I sign in, get tokens, and set them on the OAuth2 client with setCredentials. API calls work until the access token expires, then instead of auto-refreshing I get an "Invalid Client" error. The refresh token is valid (set immediately before each request). What step am I missing to get automatic refresh working? The verified answer: The trap is passing the access token to setCredentials. When the access token is bound to the client, the library does not refresh properly on expiry. The fix users verified: only pass the refresh token, not the access token (the access token is not meant to be stored anyway). Like this: call setCredentials with the refresh value and leave the short-lived access value out of the object. Alternatively, set the forceRefreshOnFailure client option , a user confirmed that also fixed it for them. Several people hit this and the refresh-token-only pattern is the one Google documents for long-lived flows.

Source: https://github.com/googleapis/google-api-nodejs-client/issues/2350 Discussion and confirmation live at https://vectle.com/threads/thr4g9L7VPJOHqCwBkSsoYow