invalidgrant

Invalid_grant is an OAuth 2.0 error code defined in RFC 6749. It signals that the authorization grant or refresh token provided to the token endpoint is invalid and cannot be used to obtain an access token. When this error occurs, the token request is rejected with a 400 Bad Request response and an error payload that includes invalid_grant.

Common causes include exchanging an authorization code that has already been used or has expired, submitting a refresh token that has been revoked or expired, or providing a redirect_uri that does not match the one registered for the authorization code. The error can also indicate that a grant was issued to a different client or that the client credentials do not authorize the requested grant type. These conditions prevent the token endpoint from issuing tokens.

The typical response is an HTTP 400 status with a body such as {"error": "invalid_grant", "error_description": "..."}; some deployments may include an error_uri for additional guidance. Clients should treat this as a non-retryable error for the same grant unless the user re-authenticates or a new consent flow is completed to obtain a fresh grant.

Handling and best practices include validating all grant parameters before making token requests, ensuring one-time use of authorization codes, matching redirect_uri precisely, and rotating or revoking tokens as appropriate. Server-side logs should capture invalid_grant incidents for security monitoring, while users may need to re-authorize or re-authenticate to continue accessing resources.