Search code examples
node.jsoauthoauth-2.0google-apiaccess-token

Google oAuth2 Access Token: "invalid_grant"


Similar question to this, except those answers are outdated and not applicable to my current situation.

Here's my webapp's signin flow:

  • Log in with Google (forces prompt, gives offline approval)
  • I successfully get a profile back with an access token and a refresh token
  • I do a few bits and pieces, then use that refresh token to generate an access token and download the user's contact list

This was working fine (last tested a week ago) but today it's suddenly giving me:

 error: invalid_grant

I'm using Node's xoauth2 package, and this hasn't been updated since June so I can't see why this would suddenly be a problem now - unless Google has changed something on their end in the past week or so?

Sample of the code I'm using that calls the error:

  // User credentials - all verified working + correct
  xoauth2gen = xoauth2.createXOAuth2Generator({
      user: email,
      clientId: configAuth.googleAuth.clientID,
      clientSecret: configAuth.googleAuth.clientSecret,
      refreshToken: refresh
  });

  // SMTP/IMAP
  xoauth2gen.getToken(function(err, token){
      if(err){
          return console.log("XOAUTH2 Error: " + err);
      }
      if(type === "full"){
        cb(token);
      }
  });

Edit: For completeness, the scopes I'm using when generating the refresh token are:

app.get('/auth/google', 
  passport.authenticate('google', 
  { 
  scope : ['https://mail.google.com/', 
           'profile', 
           'email',
           'https://www.googleapis.com/auth/userinfo.profile', 
           'https://www.google.com/m8/feeds'],
          accessType: 'offline', 
          approvalPrompt: 'force' 
  }
));

Solution

  • This was eventually fixed by deauthorizing my app in my Gmail account, deleting the refresh token I had stored in MongoDB and starting from scratch. Appears that it was simply a case of some permissions that I had changed, that hadn't been granted via oAuth2.