OAuth2: invalid_grant (refresh token expired)

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

# Re-authenticate user to issue new refresh token
# Ensure redirect_uri matches exactly
# Do not reuse refresh token across clients
# Check provider token expiry/rotation policy

How to diagnose Security errors

Security errors are usually a control working correctly. A rejected JWT, a CSP violation, an SELinux denial or a host key mismatch is the system telling you an invariant was broken, and the right response is to understand the invariant, never to disable the control. Two of these deserve special caution: an SSH host key mismatch can indicate a genuine interception, and JWT algorithm confusion is an active exploitation technique, not a configuration nuisance.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

1. Decode tokens locally and check exp, nbf, iss and aud. Never paste a live token into an online decoder. It is a credential.
2. Pin the accepted JWT algorithm explicitly on the verifying side. Accepting whatever the token's header claims is the algorithm-confusion vulnerability.
3. For SELinux, read the actual denial: ausearch -m avc -ts recent | audit2why. Set the correct file context with semanage fcontext rather than running setenforce 0.
4. For CSP violations, read the browser console message. It names the exact directive and blocked URI. Add the specific source, not a wildcard.
5. For an SSH host key mismatch, verify the new fingerprint out of band before removing the old key. This warning exists to catch man-in-the-middle attacks.

Tools worth reaching for

• ausearch / audit2why
• openssl x509 -noout -text
• ssh-keygen -lf
• browser CSP console reports
• local JWT decoding

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

📖 datatracker.ietf.org

Related Security errors

• Cookie: SameSite=None requires the Secure attributeBrowsers reject a cookie that declares SameSite=None without Secure. Cross-site cookies must…
• CORS: credentialed request cannot use a wildcard originWhen a request sends cookies or an Authorization header, the browser requires…
• CSP: Refused to connect to URLContent Security Policy blocks outbound fetch/WebSocket/XHR to the target origin because…
• CSP: Refused to execute inline script because it violates the policyContent-Security-Policy blocked an inline or an inline event handler. This is the policy…
• CSRF: Token invalid or missingCross-Site Request Forgery token is invalid, expired, or missing from request.
• GitHub: push declined due to repository rule violations, secret detectedPush protection found a recognisable credential in a commit and blocked the push. The secret…
• JWT: Invalid audience claimaud claim in JWT does not match expected audience for the API or resource server.
• JWT: Token expiredJSON Web Token has exceeded its expiration time. Need to refresh token or re-authenticate.

See all 25 Security errors →

Browse other categories

• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
• Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.