Skip to main content

Handling revoked access

A connection that worked yesterday can stop. When it does, /oauth/token answers 400 with invalid_grant:

{
  "error": "invalid_grant",
  "error_description": "this connection was revoked; the user must sign in again",
  "help_url": "https://developers.telebroad.com/docs/authentication/revoked-access#connection-revoked"
}

What your app must do​

  • invalid_grant on /token is final. Never retry it.
  • Discard the stored refresh token.
  • Send the user through authorize again.
  • An access token that was already issued keeps working until it expires, up to 1 hour. The next refresh after that fails.

Read error_description to tell the user why. The causes are below.

This connection was revoked​

this connection was revoked; the user must sign in again

Who undoes it. The user, who signs in again. Users manage their own connections, and an admin can remove one.

Where. Your profile: press My connected apps.

The same message is returned when a refresh token is used twice. Refresh tokens rotate, so persist the newest one after every refresh.

This app was removed​

this app was removed; the user must sign in again

Who undoes it. An admin of the company that owns the app. Removing an app disconnects everyone who used it. Adding the app again gives it a new client_id.

Where. OAuth apps.

This user's role is no longer allowed​

this user's role is no longer allowed to use this app; the user must sign in again

Who undoes it. An admin, by allowing that role to use the app again. See who can use an app.

Where. OAuth apps.

The refresh token expired​

the refresh token has expired; the user must sign in again

Who undoes it. Nobody has to. The user signs in again through your app.

Where. Start authorize again.