Skip to content

Invalid Grant

URI: https://docs.ankatech.co/errors/invalid_grant
HTTP Status: 400 Bad Request

This error also corresponds to the RFC 6749 OAuth 2.0 error code invalid_grant of the same name. The RFC 9457 type suffix uses the identical underscore form so the two identifiers match.

When you see this

The authorization code or refresh token presented at the token endpoint is invalid, expired, already used, revoked, or does not match the request. Every such refusal has the same body, so the answer never says which check failed.

Common Causes

  • An authorization code that is unknown, already redeemed, older than its 60 seconds, presented with a wrong code_verifier, or presented with a client_id.
  • A refresh token that expired, was revoked or rotated, or reached its session's absolute lifetime.
  • A refresh token presented with a client_id: a person's refresh token rides the HttpOnly refresh cookie, and one presented with any client_id is refused.
  • A session whose record does not state how it was opened (the console's authorization code, an emergency access or a federated sign-in). It does not refresh: the refresh is answered as a session past its absolute lifetime, and the session ends with every access token it issued.
  • A refused tenant switch (refresh_token with tenant_id): the presented refresh token stays usable for its own tenant.

Response Example

{
  "error": "invalid_grant",
  "error_description": "Refresh token is no longer valid. Please re-authenticate.",
  "error_uri": "https://docs.ankatech.co/errors/invalid_grant",
  "type": "https://docs.ankatech.co/errors/invalid_grant",
  "title": "Invalid Grant",
  "status": 400,
  "detail": "Refresh token is no longer valid. Please re-authenticate.",
  "instance": "/api/v3/auth/token",
  "timestamp": 1730000000
}

Content-Type: application/json — not application/problem+json. RFC 6749 §5.2 defines the token endpoint's error response, and the Auth API emits that shape deliberately: the RFC 9457 members ride along for clients that read them, but no RFC 9457 media type or envelope is emitted on this endpoint. Switch on the status and the error member, never on the media type.

The Auth API carries no correlation member in the body: correlate through the X-Correlation-Id response header instead. See Error Index & Overview.

How to Resolve

  1. For an authorization code, start a new sign-in: a code is redeemed once, within 60 seconds, with the verifier of its own request and no client_id.
  2. For a refresh token, sign in again in the console.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.