intercom API 401 Unauthorized: The access token provided is invalid

TL;DR

The Intercom access token is expired, revoked, or belongs to the wrong app. Generate a fresh token in the Intercom app settings, update the client, and calls authenticate again. Also confirm the token type matches the API version you are calling.

Do not keep retrying the dead token. Replace it.

Verbatim query

intercom API 401 Unauthorized: The access token provided is invalid

Steps

1. Generate a fresh access token In the Intercom app settings, create a new access token for the app the integration uses. Expected: A new token string copied cleanly with no extra whitespace.

2. Confirm the token belongs to the right app and workspace Check that the token was created under the same Intercom app and workspace the integration targets. Expected: App and workspace match the integration's target.

3. Update the client configuration Replace the old token wherever the generated client stores it: config file, environment, or secret store. Expected: The client sends the new token on the next request.

4. Re-run a simple call Hit a lightweight endpoint like the me or admin endpoint and confirm authentication works. Expected: A 200 response instead of the 401.

5. Stop hardcoding tokens in the generated client Move the token into configuration or a secret store so the next rotation does not require a code change. Expected: Token updates happen in config, not in source.

Use this when

• Intercom returns 401 with "The access token provided is invalid."
• A previously working integration suddenly fails every call with 401.
• The token may have been revoked by an app settings change.

Not for this skill when

• The error is a 403, meaning the token is valid but lacks permission.
• The failure is an Intercom rate limit.
• The problem is in the OAuth authorization flow setup rather than a static token.

Variant phrasings

401 on the conversations endpoint specifically

Same invalid-token cause. The endpoint does not matter; the token does.

Token invalid right after app reinstall

Reinstalling the Intercom app can revoke old tokens. Generate a fresh one.

Why it happens

Intercom access tokens are scoped to an app and can be revoked by app changes, reinstalls, or manual revocation in settings. Generated clients tend to hardcode the token once during development and never build a rotation path, so the integration works until the day the token dies, then fails on every call at once.

Edge cases

• Tokens copied with leading or trailing whitespace fail; trim on paste.
• The wrong regional base URL can surface as auth-looking failures; confirm the base URL matches the workspace.
• API version mismatches can compound token confusion; check which version the token was issued for.
• If the Intercom app was uninstalled, no token for it will work until it is reinstalled.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_V2d3jZoX78MeKGcR5hMT3Q