OAuth Refresh Token Expired — How to Handle It

A refresh token expires silently — your app keeps working until the next API call fails with invalid_grant or token_expired. Handle it gracefully: catch the error, clear tokens, redirect to login.

Why refresh tokens expire

• Inactivity timeout — providers expire refresh tokens after a period of no use (Auth0 default: 30 days, Cognito: 30 days, Google: 6 months)
• Token rotation — each refresh produces a new refresh token and invalidates the old one. Using an old token causes invalid_grant
• User revoked access — the user disconnected your app via provider settings
• Password changed — some providers revoke all tokens when a password changes

Catch expiry in your token refresh logic

async function getValidToken() {
  const stored = getStoredTokens();
  if (!stored) return promptLogin();

  // Check if access token is still valid
  if (Date.now() < stored.expires_at - 60000) {
    return stored.access_token;
  }

  // Try to refresh
  try {
    const fresh = await refreshAccessToken(stored.refresh_token);
    storeTokens(fresh);
    return fresh.access_token;
  } catch (err) {
    if (err.error === 'invalid_grant' || err.status === 401) {
      clearTokens();
      promptLogin(); // redirect to /login
      return null;
    }
    throw err; // re-throw other errors
  }
}

Token lifetimes by provider

Silent re-authentication for SPAs

If you want to avoid visible login prompts, use silent auth — an invisible iframe that attempts to get a new token using a session cookie:

// Auth0 example — checkSession
auth0.checkSession({}, function(err, result) {
  if (err) {
    // Session expired — full login required
    auth0.authorize();
  } else {
    // New tokens in result
    updateTokens(result);
  }
});