Okta Error refresh_scopes_denied Occurs When Refreshing Access Tokens
Last Updated:
Overview
The refresh_scopes_denied error occurs when attempting to refresh an access token with requested scopes that the original access token did not grant. Resolve this issue by ensuring the scopes in the refresh token request match those in the original access token. This error appears in the System Log and occurs when using either an Org Authorization Server or a Custom Authorization Server.
Applies To
- OpenID Connect (OIDC)
- Refresh tokens
- Refresh access tokens and rotate refresh tokens
Cause
The refresh_scopes_denied error occurs when attempting to refresh an access token with requested scopes that were not originally granted.
Note: This error can occur when using either an Org Authorization Server or a Custom Authorization Server. The examples provided below illustrate the Org Authorization Server since it is universal.
This error is shown in the System Logs:
The debug data in the system logs will show what scopes were requested when refreshing the token:
One potential cause is requesting Okta API scopes that have not been granted to the client and making an API request to refresh the token that includes those scopes. When requesting Okta API scopes in an authorize request and the scope has not been granted to the client on the Okta API Scopes tab for the application, the authorization will not fail, but the token will be granted without that scope.
Solution
How is the refresh_scopes_denied error resolved?
To prevent this error, ensure that the scopes in the refresh token request do not contain scopes not granted in the original access token:
If the requested scopes at the time of authorization request will include Okta API scopes, make sure those scopes are granted to the client:
