Google oAuth2 Access Token: "invalid_grant"

Question

Similar question to this, except those answers are outdated and not applicable to my current situation.

Here's my webapp's signin flow:

Log in with Google (forces prompt, gives offline approval)
I successfully get a profile back with an access token and a refresh token
I do a few bits and pieces, then use that refresh token to generate an access token and download the user's contact list

This was working fine (last tested a week ago) but today it's suddenly giving me:

 error: invalid_grant

I'm using Node's xoauth2 package, and this hasn't been updated since June so I can't see why this would suddenly be a problem now - unless Google has changed something on their end in the past week or so?

Sample of the code I'm using that calls the error:

  // User credentials - all verified working + correct
  xoauth2gen = xoauth2.createXOAuth2Generator({
      user: email,
      clientId: configAuth.googleAuth.clientID,
      clientSecret: configAuth.googleAuth.clientSecret,
      refreshToken: refresh
  });

  // SMTP/IMAP
  xoauth2gen.getToken(function(err, token){
      if(err){
          return console.log("XOAUTH2 Error: " + err);
      }
      if(type === "full"){
        cb(token);
      }
  });

Edit: For completeness, the scopes I'm using when generating the refresh token are:

app.get('/auth/google', 
  passport.authenticate('google', 
  { 
  scope : ['https://mail.google.com/', 
           'profile', 
           'email',
           'https://www.googleapis.com/auth/userinfo.profile', 
           'https://www.google.com/m8/feeds'],
          accessType: 'offline', 
          approvalPrompt: 'force' 
  }
));

Bruno Casarotti Bruno Casarotti · Accepted Answer · 2015-12-01T19:01:34

According to RFC 6749 invalid_grant is returned when:

The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.

Check this out here

Google oAuth2 Access Token: "invalid_grant"

3 Answers