CODEWITHSUNDEEP
youtube-apigoogle-oauth
Brian
Brian

Reputation: 38025

Getting "invalid_grant" error when exchanging a refresh token for an access token

I've seen this issue in a lot of questions, but so far, none seem to apply to my situation.

The problem we are having is we are getting an "invalid_grant" error when we attempt to get an access token. This only happens to some accounts, but when it does happen, in every case I looked at, the refresh token worked before, and now has stopped working. This is happening far to frequently for it to be customers revoking access (seems to be nearly 20% of the channels we manage in the last couple weeks have been invalidated).

As a note, we have a backend process that uploads the videos to our customer's YouTube channels.

  1. We use OAuth2 to get a refresh token, here are the parameters we send...

    scope = "https://www.googleapis.com/auth/youtube", client_id = "", response_type = "code", access_type = "offline", approval_prompt = "force", redirect_uri = "http://www.us.com/OAuth/YouTube"

NOTE: for client_id we use the email address that is in the Google API manager (or was, I just looked and it is no longer there). We used to use the client ID from this page, but that caused us problems as well. Did this change? Should we be using the client ID from this page now?

  1. We exchange the code that is returned for a refresh and access token and store the refresh token in our database.

  2. The backend process exchanges the refresh token for an access token and this is where we seem to be getting the "invalid_grant" error.

Guaranteed only a single access token for the channel is in use at any time (25 limit doesn't apply). We don't store the access token, we get a fresh one every time we process a channel.

Any ideas what might be happening? Something to look for? See note above about client ID. This might have something to do with it, but I'm hesitant to try it since using the "Client ID" from the API manager caused problems before.

Upvotes: 3

Views: 14883

Answers (2)

Linda Lawton - DaImTo
Linda Lawton - DaImTo

Reputation: 117086

Guaranteed only a single access token for the channel is in use at any time (25 limit doesn't apply). We don't store the access token, we get a fresh one every time we process a channel.

This statement is incorrect: Access tokens can be used as many times as you need while they are still good (for an hour).

Answer:

"invalid_grant" basically means that your refresh token no longer works. The only solution to the problem is to request access again and get a new one. The question should be why is it expiring in the first place.

Assuming that the user did not revoke access, and that the refresh token has been used to request a new access token within the last six months. This is probably an issue with it being over written.

When a user authenticates your application you are given a refresh token. This refresh token is associated to the client id of your application and the user who has just authenticated. If said user then authenticates your application again you will get another refresh token. Again this refresh token is associated to the user and your projects client id. Both of these refresh tokens will work. Your user can keep doing this up to 25 (Note I think the changed it recently to 50 but I haven't tested it with all APIs yet) once they have hit this magic number the first refresh token will expired and if you try and use it you will get an invalid grant.

The only solution is then to just request authentication again. It is important to always save the most recent refresh token that your user has granted your application. In the event (like me) you have an application that is stored on a number of servers all requiring authentication. Your going to have to tell them not to refresh it to many times or they will have to go back and reauthenticate the first one that they expired.

If this is happening with ALL of your requests. You can also check that you server is sync with (NTP) and that you are sending the payload of your request in the post field. Not attached to the authentication end point like a HTTP GET (been there done that).

Upvotes: 2

Teyam
Teyam

Reputation: 8102

Here are the possible reasons why a token stops working and becomes invalid:

  • The user has revoked access.
  • The token has not been used for six months.
  • The user changed passwords and the token contains Gmail scopes.
  • The user account has exceeded a certain number of token requests.

As you can see, it's not recommended that you request a fresh one every time you process a channel. As also mentioned in Token expiration:

If you need to authorize multiple programs, machines, or devices, one workaround is to limit the number of clients that you authorize per user account to 15 or 20. If you are a Google Apps admin, you can create additional admin users and use them to authorize some of the clients.

With regards to the use of client_ID, it is usually needed to call the sign-in API as mentioned in Creating a Google API Console project and client ID.

And lastly, this Google Groups discussion - OAuth 2.0 400 - error:invalid_grant and ideas? might also help.

Upvotes: 0

Related Questions