Search code examples
google-apigoogle-oauthgoogle-developers-console

I want to use Google API refresh tokens forever

There is a process to obtain a refresh token via OAuth authentication for Google API, and then obtain an access token from the refresh token to validate the receipt.

The other day the refresh token suddenly expired and the receipt validation failed. Our service stopped processing billing. Below is the error when it failed.

{
  "error": "invalid_grant",
  "error_description": "Token has been expired or revoked."
}

I thought refresh tokens reset their expiration date each time they are used, so why did they expire? I don't think the following rules apply.

You must write your code to anticipate the possibility that a granted refresh token might no longer work. these reasons:

  • The user has revoked your app's access.
  • The refresh token has not been used for six months.
  • The user changed passwords and the refresh token contains Gmail scopes.
  • The user account has exceeded a maximum number of granted (live) refresh tokens.
  • The user belongs to a Google Cloud Platform organization that has session control policies in effect. (https://developers.google.com/identity/protocols/oauth2)

I want to use the refresh token forever. Thank you in advance.

Solution

  • Refresh tokens do not expire by design there are a few things that can cause them to expire as you have listed. However there is one you have not listed.

    If you check the docs for Experation you will find it also says.

    enter image description here

    If your app is in testing set it to production and your refresh token will stop expiring.

    enter image description here

    So as long as your app is in production, the user does not revoke your access, and they have less then 50 outstanding refresh tokens for that user, and you have used it at least once in the last six months. (gmail scope the user does not change their password). The refresh token should not be expiring.

    That being said your system should be designed to handle a refresh token expiring and request access of the user again. or notifying the admin if this is a backend system.