invalid_grant — OAuth token revoked or expired
Your mailbox is misconfigured
invalid_grant means the refresh token used to mint access tokens is no longer valid, so the mailbox can no longer be reached on the owner’s behalf. The connection must be re-authorised by the mailbox owner or re-granted by an admin; no retry will recover it.
What the server actually says
invalid_grant | Token has been expired or revoked.What you see
A mailbox that worked for weeks stops sending with no change on your side. Everything else about the account looks healthy.
Why it happens
- The mailbox owner changed their account password, which revokes issued refresh tokens.
- The user or an admin removed the app from their connected applications.
- The token went unused past its idle expiry - unused refresh tokens on some tenants expire after a period of inactivity.
- The OAuth client is still in testing status, where refresh tokens expire after seven days.
- Admin consent for the tenant was withdrawn, or domain-wide delegation scopes were changed.
How to fix it
- Re-authorise the mailbox. Have the owner reconnect through the normal OAuth flow. This issues a fresh refresh token; the old one cannot be revived.
- Check the OAuth app is in production, not testing. A Google OAuth client left in "Testing" issues refresh tokens that expire after seven days, which produces invalid_grant on a weekly rhythm.
- For domain-wide delegation, re-confirm the scope grant. Changing the scope list on a DWD client invalidates existing grants. The admin must re-authorise the exact scope set.
- Surface it to the mailbox owner immediately. Only the owner or an admin can fix it, so silent retrying just produces a mailbox that quietly stopped working.
What not to do
- Do not retry the refresh. invalid_grant is terminal for that token - every retry returns the same thing.
- Do not delete and recreate the mailbox record automatically. The history, ramp progress, and reputation data attached to it are worth keeping.
- Do not treat it as a provider outage. The provider is answering correctly and promptly.
Frequently asked questions
Why did it happen with no warning?
Nothing on the sending side changes when a token is revoked. The most common trigger is the mailbox owner changing their password, which silently invalidates every issued refresh token.
Can I refresh a revoked refresh token?
No. A refresh token is the long-lived credential; once revoked, the only path is a new authorisation granting a new one.
Does this affect domain-wide delegation too?
Yes, though differently - for DWD the grant lives on the admin’s client, so changing the authorised scope list invalidates existing delegation and an admin has to re-approve.
How MailPilot helps
MailPilot classifies this error automatically on every connected mailbox and tells you which side is at fault, so a throttle is never mistaken for a dead recipient and a credential failure never suppresses a healthy address. It also monitors real inbox placement and checks SPF, DKIM and DMARC on every mailbox, which is where most policy rejections start.
Related errors
Last reviewed 2026-10-11 by the MailPilot team.