'Token has been expired or revoked' - Google OAuth2 Refresh token gets expired in a few days

Question

I am using Google Analytics API to fetch analytics data. I tried to authenticate it using following steps:

• Created OAuth client ID in https://console.developers.google.com/ credentials section.
• In consent screen I had set publishing status as testing
• In OAuth 2.0 Playground I got the refresh token using above generated client id and client secret
• Then I am using it to generate access token through it.

But after a few days, the refresh token expires although it is mentioned that the refresh token's validity is life long.

Ornamented

Answer 1

If your app is in testing mode then user tokens will expire in 7 days. Please find this explanations here: https://support.google.com/cloud/answer/10311615#zippy=%2Ctesting

Ina

This was my problem. Thanks! – Carrousel

Visit the OAuth consent screen and click on the publish button to change from the testing status to the published status. – Luck

@Luck Google wants verification to publish the app. Is there any way to by-pass the verification process? – You

@You IIRC, you don't need to verify to publish the app. Users will be warned about an untrusted application if you haven't verified it. For testing purposes, this is fine but if you're deploying to production, I don't think there's a way to bypass verification. – Luck

Just wanted to confirm what Spikatrix said as the wording in the Google Cloud Console is very misleading. You DON'T need to verify the app despite all the warnings in the console. My experiments have shown that, as long as the app "Publishing status" says "In production", the tokens will NOT expire after 7 days. – Gingergingerbread

Unfortunatly this doesn't seem to solve my problem.. my app has the status 'production' but the token still expires after 7 days. – Impiety

@AlexvanEs you solved your problem of refresh token expiring?? – Nose

@AlexvanEs Did you manage to find a solution for this? – Isolating

@NihalChandwani DId to manage to find a solution for this? – Isolating

@Isolating we need to verify app, no option to that, refresh token is needed, that too will expire in 7 days, and about access token, it will expire in 1 hour – Nose

@NihalChandwani , If we publish the app in Production mode, the Refresh token will not expire in 7 days right? – Isolating

@Isolating yes, according to my research – Nose

OMG Man u saved my life – Refrigeration

Answer 2

I needed to send mails from a gmail account that I have access to, using nodemailer. It works for a couple of days before my refresh token is mysteriously revoked, even though the account belongs to me. A google search brought me here and I had been watching for a while hoping someone would help with a solution.

As you mentioned, this seems to happen with only test/unverified apps and I'm guessing google revokes tokens for such applications in your account after a few days. After much trials and errors, here is what I did.

NOTE: This is solution is only applicable to accounts you own, otherwise you must verify your app to access other people's accounts

1. Generate a new refresh token (existing one is most likely revoked) as described in this SO post
2. Go to the security tab of your google account dashboard
3. Under the Recent security activity section, you should see a security alert for your app.
4. Click on the context menu next to the notification and click DISMISS
5. At this point you'll be presented with a dialog of options where you indicate the level of trust you have for the app. I just went ahead and said I trusted the developer/app, obviously. And that's it! The refresh token should persist after this.

I could not find anything related anywhere else.

Inspiratory

Is this supposed to prevent the new token from expiring after a week? I dismissed the security notification last week, and my new token has now expired again. Hoping I'm missing something. According to Google's API verification exceptions, verification isn't required for personal use, but there are no details on how to indicate the app is for personal use rather than in testing. – Baggett

This workaround didn't work for me. I found the security activity menu and dismissed, but the token still expired 7 days later. – Gingergingerbread

@EtienneDechamps It turns out this is the case as mentioned by above https://mcmap.net/q/403879/-39-token-has-been-expired-or-revoked-39-google-oauth2-refresh-token-gets-expired-in-a-few-days. A maximum validity of 7 days is given to tokens for test apps. – Inspiratory

you should see a security alert for your app Nope. – Hadlock

Answer 3

The other answer pointed me in the right direction but for me the option was located somewhere else: security > security checkup/security issues found > context menu next to your app > dismiss

Celestyn

Answer 4

What I did:

1. Go to https://console.cloud.google.com/apis/credentials/consent and change from the testing status to published.
2. Delete the current token file.
3. Authorize the API again by signing into your gmail account. You will be sent to a warning screen. From there, you can choose to proceed.
4. When done you'll get a new token file

Shunt

This only get you into a back and forth conversation with google team trying to verify your app. in the end, they only say that since its for personal use, to keep using unverified app.. and we still end up having to manually change the token every week – Louis

As @etienne-dechamps stated, "You DON'T need to verify the app despite all the warnings in the console" – Drown

Answer 5

The solution is to delete your token.json file to force Google to find a new token.

I was able to get it to work WITHOUT a verified app. Perhaps the refresh() method will work once my app is verified. Not sure on that one.

Puri

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Stationer

Answer 6

This issue seems to be for unverified apps, Simply delete the token file from your project and rerun the project, it will create a new token.

Crept

Actually it seams to have nothing to do with being verified. Its only if the app is still in testing. – Yasminyasmine

Answer 7

My problem was when I've added access_token instead of refresh_token.

Cicatrix

Answer 8

Had this issue with Woocommerce Bookings Calendar Sync app. Kept getting disconnected and there was nothing in the documentation. Reached out to their support who told me to go to the OAuth consent screen and change Publishing status from "Testing" to "In production"

This is the error I noticed:

ERROR Unable to fetch access token with refresh token. Google sync disabled until re-authenticated. Error: "invalid_grant", "Token has been expired or revoked." NOTICE Invalid access token. Reconnect with Google necessary. Code 0. Message: Invalid token format.

Bielefeld