错误：invalid_grant，用于使用刷新令牌获取访问令牌

Question

After googling we came to know that invalid_grant which means refresh token is invalid.

Link to google oauth doc

We don't have any of these issues mentioned by google. Is this error related to something else rather than a refresh token.

More Info

We have access to read, write spreadsheet and send gmail

We fetch an access token for each request Any help would be appreciated.

We're already in production and verified by google

Answer 1

Without seeing the full error message that being

Invalid_grant {Message here}

It is hard to help but from my experience is most often caused by one of the following.

Refresh token expire, app not in production.

There are serval reasons why a refresh token can expire the most common one currently is as follows.

A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days.

The fix is to go to google developer console on the consent screen and set your application to production, then your refresh token will stop expiring.

invalid_grant: Invalid JWT

{ “error”: “invalid_grant”, “error_description”: “Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe. Check your iat and exp values and use a clock with skew to account for clock differences between systems.” }

Your server's clock is not in sync with NTP. (Solution: check the server time if its incorrect fix it. )

invalid_grant: Code was already redeemed

Means that you are taking an authentication code that has already been used and trying to get another access token / refresh token for it. Authentication code can only be used once and they do expire so they need to be used quickly.

Invalid_grant: bad request

Normally means that the client id and secrete you are using to refresh the access token. Was not the one that was use to create the refresh token you are using.

Always store most recent refresh token.

Remember to always store the most recent refresh token. You can only have 50 out standing refresh tokens for a single user and the oldest one will expire. Depending upon the language you are using a new refresh token may be returned to you upon a refresh of the access token. Also if you request consent of the user more then once you will get a different refresh token.

User revoked access

If the user revoked your access in their google account, your refresh token will no longer work.

user changed password with gmail scope.

If your refresh token was created with a gmail scope and the user changed their password. your refresh token will be expired.

Links

Oauth2 Rfc docs for invalid_grant error rfc6749

invalid_grant The provided authorization grant (eg, authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.