I am having issues with using a stored refresh_token from Google APIs to grant a new access_token.
Our sign-up flow guarantees that only one account is authed with our client. When testing locally with a Google Account I control, I receive an access_token and refresh_token that is persistently stored. The access_token works to retrieve the necessary data prior to its expiration. If I try to refresh this access_token at any time following this guide I receive an "invalid_grant" "Token has been expired or revoked.". I can verify that the account still has access through the admin panel. My refresh POST looks like:
POST /oauth2/v4/token HTTP/1.1
Host: www.googleapis.com
Content-Type: application/x-www-form-urlencoded
client_id=[MY_CLIENT_ID.apps.googleusercontent.com]&client_secret=[MY_CLIENT_SECRET]&refresh_token=[USER'S_REFRESH_TOKEN]&grant_type=refresh_token
Hitting this endpoint to verify the access_token:
GET /oauth2/v3/tokeninfo?access_token=[USER'S_ACCESS_TOKEN] HTTP/1.1
Host: www.googleapis.com
Yields information if the access token is not expired, but after it has expired I receive a 400 "Invalid Value" as expected.
Since I have been manually testing the refresh_token POST, I do not think there is a throttle happening on Google's side.
I have verified that we have access_type:offline during the sign up process. I am able to get all the requested data during the initial access_token period which leads me to believe the permissions are correct for the data we would like to access.
What am I missing here?
