Okta Workflows Connection Fails with "The refresh token is invalid or expired" Error and Requires Reauthorization
Last Updated:
Overview
An Okta Workflows connection fails with an invalid or expired refresh token error because an action clears the session for the authorizing account. Resolve this issue by searching the System Log to identify the actor who cleared the session, and update the workflow logic to prevent clearing the connection account session. Attempting to execute any Okta action cards in a workflow returns the following error when the workflow previously executed successfully:
{"error":{"status":500,"message":{"statusCode":400,"data":"{"error":"invalid_grant","error_description":"The refresh token is invalid or expired."}"}}}
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Workflows
- Okta Connector
Cause
This error occurs if an action clears the session for the account used to authorize the Okta connection, which revokes the OAuth tokens. A workflow that uses the Clear User Sessions card can inadvertently clear the session.
Solution
How is the invalid refresh token error resolved?
Search the System Log for the account ID used to authorize the connection during the failure time frame to determine if Okta deliberately cleared the session.
- Navigate to Reports and select System Log in the Okta Admin Console.
- Enter the following query, replacing
<account_id>with the ID of the account used to authorize the connection:
eventType eq "user.session.clear" and target.id eq "00urduzspHCdrPdL25d6"Review the System Log event details to identify the actor and user agent associated with the session clear event.
- Expand the event and use the Actor object to identify the user who cleared the session.
- Check the Client > UserAgent > RawUserAgent attribute. If the attribute displays Azuqua, Workflows initiated the action, and the Actor is the account used for the Okta connection.
- Identify which workflows use the Clear User Sessions card.
- Add logic to the workflow to prevent clearing the session for the account used in the Okta connection.
- Reauthorize the connection.
