Troubleshooting

invalid_grant: the code or refresh token is rejected

The authorization code was already used, has expired (it only lasts a few minutes), or the exchange request does not match the original request (different redirect_uri or code_verifier). A revoked or already consumed refresh token gives the same error.

invalid_grant: the code or refresh token is rejectedinvalid_grant

Cause probable. The authorization code was already used, has expired (it only lasts a few minutes), or the exchange request does not match the original request (different redirect_uri or code_verifier). A revoked or already consumed refresh token gives the same error.

What to do? Exchange the code only once, and straight away. Send exactly the same redirect_uri as at the authorization step, and the code_verifier that matches the code_challenge. If refresh tokens rotate, always keep the last one received.

To see exactly which check fails, paste the response into theanalyseur, or paste the message into the diagnostic.

Related errors

All SAML and OpenID Connect errors

Want to see it for real? ID-Kit plays the role you are missing and shows you each step.

Open my spaceDecode a SAML response