BAD_REFRESH_TOKEN error when attempting to refresh access token


#1

When attempting to refresh my access token i get the following response from the API. The refresh token was issued 5 mins prior.
{"status":"BAD_REFRESH_TOKEN","message":"missing or invalid refresh token","correlationId":"XXXX","requestId":"9aa76c90559dfe99ce68e147a800c799"}


#2

Hi @shamilton, welcome! Can you provide a bit more context here: What is your App ID, and the Hub ID of the account that you're making a request to? The ‘BAD_REQUEST_TOKEN’ generally indicates a missing/malformed parameter in the request.

If you’re seeing a BAD_REFRESH_TOKEN error with a refresh token that was previously shown to be valid, it’s likely that the account associated with that refresh token uninstalled the integration. If an account uninstalls the application (or more rarely, an account expires) then refresh tokens are invalidated.

Could any of what I suggested above be the issue in your case?


#4

Hi, @Connor_Barley. I encounter the same issue several times.
I have not deleted the refresh-token, but got BAD_REQUEST_TOKEN while doing the refresh token.
Then, I don't know where to track the issue (no log or oauth monitoring).
I can only try refresh-token info api and got this:

{
    "status": "error",
    "message": "resource not found",
    "correlationId": "791a2f95-29bc-40ee-98bf-379ed256ce33",
    "requestId": "17be6f92f575ff9b6b064ab227242c86"
}

I can give you an example, below one is the case in last week. (around 2019-01-11T07:47:10.111+0000)

refresh token: 92844e4e-4314-4334-a0a2-b8a194091c60
hub_id: 5272563
app_id: 185944

Thanks.


#5

Hi @eaglerayp, I'm also getting that "resource not found" error when hitting this endpoint: https://developers.hubspot.com/docs/methods/oauth2/get-refresh-token-information.

To be transparent, we don't have logs about why a refresh token might be invalidated so I can't say for sure what might have happened, but the two reasons you'll see this are if

  1. You've deleted the refresh token
  2. A user uninstalls your application

I'd recommend just generating a new refresh token.