An invalid grant error occurs when accessing the token endpoint can be caused by a mismatched client ID, an expired authorization code, or an invalid refresh token. Resolve this issue by verifying the client ID, generating a new authorization code, or initiating a new authentication flow to obtain a new set of tokens. The /token endpoint returns one of the following errors:

"error": "invalid_grant", "error_description": "The grant was issued to another client. Please make sure the client_id matches the one used at the authorize request."

"error”:“invalid_grant”,“error_description”:“The authorization code is invalid or has expired.”

"error": "invalid_grant", "error_description": "The refresh token is invalid or expired."

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OAuth 2.0 / OpenID Connect Application
• /token endpoint
• invalid_grant error

• The grant issued to another client error occurs when the client_id in the /token call does not match the one from the /authorize request.
• The invalid or expired authorization code error occurs when the authorization code expires, is invalid, is malformed, or a previous request already consumed it.
• The invalid or expired refresh token error occurs when the refresh_token included in the request is invalid, expired, revoked, or already consumed, and the application has refresh token rotation enabled.

How is a mismatched client ID error resolved?

Verify the client ID value used in the initial authorization call and ensure the exact same value is used in the subsequent token request.

1. Verify the client_id value from the initial call to the /authorize endpoint.
2. Use the exact same client_id value when making the subsequent call to the /token endpoint to exchange the authorization code for a token.

How is an expired authorization code error resolved?

Generate a new authorization code by redirecting the user to the authorize endpoint and immediately using the new code to retrieve the tokens.

1. Redirect the user to the /authorize endpoint to start a new authentication and authorization request.
2. Retrieve the new authorization code that Okta provides upon successful authorization.
3. Use the new authorization code immediately to make a request to the same /token endpoint to retrieve the tokens.

How is an invalid refresh token error resolved?

Obtain a new set of tokens by initiating a new authorization request and securely storing the newly issued refresh token.

1. Initiate a new authorization request to Okta.
2. Retrieve the new refresh token and access token that Okta issues after successful authentication.
3. Store the new refresh token securely and discard the invalid token.

Related References

• Implement authorization by grant type
• Error "400 Bad Request" when Redirecting to the /authorize Endpoint with no Error Description