Google token refresh returns “Token has been expired or revoked.”

Question

I have a Google OAuth2 client approved by Google, which provides offline access to user's account with required scopes. My backend application stores and uses the refresh token to refresh the access tokens as and when needed.

Lately, we are seeing that our token refresh attempt is met with an error from Google with:

{
    "error" : "invalid_grant",
    "error_description" : "Token has been expired or revoked."
}

There is no additional information.

Nothing has changed in my Google OAuth client. The user has not changed account password. The user has not revoked access to my client.

What could be the reason for suddenly getting such errors for token refresh? And how do I avoid this in future (if possible)?

pinoyyid pinoyyid · Accepted Answer · 2018-08-14T21:50:26

Are you inadvertently asking for the refresh token multiple times? There is a limit of approx. 25 refresh tokens that an account can have extant.

Google token refresh returns “Token has been expired or revoked.”

2 Answers