Skip to main content

​
invalid_grant

Returned by the token endpoint when the presented grant cannot be exchanged:
  • The authorization code expired (10-minute TTL), was already used (single-use), or was issued to a different client_id / redirect_uri.
  • The PKCE code_verifier doesn’t match the code_challenge sent to /authorize.
  • The refresh token is expired, revoked, or belongs to a revoked family.
To recover, restart the flow at /authorize — do not retry the exchange with the same grant. See OAuth §3–4.