Why Google OAuth Returns
Blog post from Unified.to
Google OAuth may return an "invalid_grant" error for several reasons related to refresh tokens, including expiration, revocation, inactivity, user or admin restrictions, or exceeding token limits. This error indicates that the refresh token is no longer valid and cannot be used to obtain new access tokens, necessitating user reauthorization. Google documentation specifies that refresh tokens for External apps in Testing mode expire after 7 days, and each Google Account is limited to 100 live refresh tokens per OAuth 2.0 client ID, with the oldest being invalidated once the limit is exceeded. To address this, applications should provide a seamless reconnect experience by monitoring for refresh failures, treating "invalid_grant" as an indicator that reauthorization is required, and guiding users through the OAuth process again to secure a new refresh token. This approach offers a better user experience compared to a generic error message and ensures that expired access tokens are not presented to the application.