> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Invalid grant

# `invalid_grant`

| HTTP | When                                                                      |
| ---- | ------------------------------------------------------------------------- |
| 400  | The authorization grant or refresh token is invalid, expired, or revoked. |

Returned by the token endpoint when the presented grant cannot be
exchanged:

* The authorization code expired (10-minute TTL), was already used
  (single-use), or was issued to a different `client_id` /
  `redirect_uri`.
* The PKCE `code_verifier` doesn't match the `code_challenge` sent to
  `/authorize`.
* The refresh token is expired, revoked, or belongs to a revoked
  family.

To recover, restart the flow at `/authorize` — do not retry the
exchange with the same grant. See [OAuth §3–4](../oauth.md#3-authorization-code-with-pkce).