Question

I’m getting the following

{
  "error" : "invalid_grant"
}
    at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:103)
    at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:303)
    at com.google.api.client.googleapis.auth.oauth2.GoogleRefreshTokenRequest.execute(GoogleRefreshTokenRequest.java:130)

This only happens in my production Appengine instance, (ie. not on dev server), and it only happens for the email address that I use for testing on both dev and production.

My working hypothesis is that it is something to do with the user being granted a refresh-token on the dev server which is somehow interfering with the stored refresh-token on the prod server.

Can anybody confirm this explanation, and is there a best practice on how to deal with this exception?

Answer 1

Currently only the last 25 refresh tokens granted by Google work.
We basically keep a queue of size 25 of generated refresh tokens.

That mean that on your testing account if you happened to generate more than 25 refresh tokens the older ones will start to be revoked.

Maybe that is what is happening here so I wanted to point this out, it could be that you generated more than 25 refresh tokens on your dev server with your test account and the token that was in prod got dropped (because there are 25 newer ones).

That is something that is not documented about our authentication servers and as such be aware that it could change anytime.

In general when this exception happens you need to make the user go through a new OAuth 2.0 flow in order to get a new refresh token.