Google OAuth "error": "invalid_grant" response to request to exchange one time auth code for refresh and access token

user_7605846 0
Viewed 3457

I am trying to implement Google Signin for our server-side app using this documentation: Google Sign-In for server-side apps

I successfully followed steps 1-6 and were able to obtain the one time auth code. However on step 7 when I make a request to exchange the one time auth code for access token I get a response:

{
  "error": "invalid_grant",
  "error_description": "Bad Request"
}

I tried both manual HTTP POST request using CURL and also tried the official api client Python library. The response is always the same "invalid_grant".

When requesting the one time auth code I made sure to request offline access mode.

I verified that the user for whom I obtain the one time auth code indeed has granted access by going to https://myaccount.google.com/u/0/permissions and ensuring that our app is listed in the "Third-party apps with account access" with correct access scopes.

Can you please advise on how to debug this? The error message is unfortunately not helpful and I already tried everything I could find about this particular error on Stack overflow or elsewhere.

UPDATE: I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt. Hope this is help for for others that will be working on this. I with OAuth requests return more informative error messages to help with debugging.

google-signin oauth-2.0 google-oauth
1 Answers

I figured out what the problem was. Apparently the one time code is good only for one request, no matter if the request is successful or no. So, I was trying to get the refresh token and because my very first attempt was malformed the request failed and the very first failure renders the one time code invalid. Any subsequent request, even correctly formed one, using this same code fails with "invalid_grant". This is somewhat unexpected behavior, I was under the impression that "one time" means one successful attempt. Hope this is helpful for others that will be working on this. I with OAuth requests return more informative error messages to help with debugging.

user_76058460
Related