OAuth 2.0 Invalid Grant
The provided authorization grant or refresh token is invalid, expired, revoked, or does not match the redirection URI.
Root Cause
Common when using an expired refresh token or an authorization code that has already been used.
How to Fix
Restart the OAuth flow to obtain a new authorization code or verify that the refresh token is still valid.
Quick Summary
`invalid_grant` is the OAuth 2.0 token-endpoint error returned when the authorization code or refresh token is unusable, already consumed, expired, revoked, or paired with a different redirect_uri.
Key Takeaways
- Authorization codes are single-use, exchanging the same code twice always returns invalid_grant
- redirect_uri at token-exchange time must byte-exactly match the one used at authorize time
- Refresh tokens may be rotated (RFC 6749 §6), keep only the latest, discard the old one immediately
- User actions like password reset, MFA reset, or 'revoke all sessions' invalidate refresh tokens
When to use it
- Refreshing a session after a long idle period
- Token exchange failing in a backend job
- Migrating an OAuth client between hosts
Common Mistakes
- Retrying the same authorization code after a transient failure, codes are single-use, retry fails
- Storing only the original refresh token when the provider rotates it on every refresh
- Trailing slash drift between authorize and token-exchange redirect_uri values
invalid_grant OAuth 2.0 Invalid Grant, Frequently Asked
Why did my refresh token suddenly stop working?
The most common reasons: rotation (provider issued a new one you didn't save), absolute expiry (e.g. 30/60/90 days), or revocation triggered by a user security event.
Can I tell why invalid_grant was returned?
Some providers include an `error_description` field (Google, Auth0). Many do not. Add structured logging on both sides of the exchange so you can diff what the IdP saw vs what you sent.
Still having issues?
Check your network logs or use our developer tools to inspect headers, decode tokens, or validate your requests.