Invalid grant type: refresh_token

Hello.

I'm using Amazon login with account linking using grant_type: 'refresh_token'. The problem is that at some point Amazon server starts to reject my refresh token and I do not see the reason behind it.

Server responds: {"error_description":"The request has an invalid grant parameter : refresh_token","error":"invalid_grant"}.

Documentation says: The authorization code is invalid, expired, revoked, or was issued to a different client_id. However, authorization code has nothing to do with refreshing the access token.

Thank you for any help.

Best,

Urban

0 · Show 2

10 |2000 characters needed characters left characters exceeded

Attachments: Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

debugging · Jul 31, 2019 at 10:47 AM

I have the same issue using PHP. Tried with urlencode() and without. The client_Id and secret are correct. The code I use works with other Oauth2 provider (Google and Github) but with with LWA urlencoding the refresh token or not, both fail. I feel it may have something to do with urlencoding but cannot make sure.

request without urlencode:

grant_type=refresh_token&refresh_token=Atzr|IwEBIBMQ5XSi2CB8iwZodUa4IAbaX8aQkTqRPtV0dL5YXb3vPyAtB5RAK7Z&client_id=amzn1.application-oa2-client.afebbc90a4da49e4812d9800XXXXXXXX&client_secret=de5badd21a09c760164e7896a3f80a582d4218a4aac279fbe6a818eXXXXXX

request with urlencode:

grant_type=refresh_token&refresh_token=Atzr%7CIwEBIBMQ5XSi2CB8iwZodUa4IAbaX8aQkTqRPtV0dL5YXb3vPyAtB5RAK7Z&client_id=amzn1.application-oa2-client.afebbc90a4da49e4812d980XXXXXXXX&client_secret=de5badd21a09c760164e7896a3f80a582d4218a4aac279fbe6a818eXXXXXXX

The documentation here https://images-na.ssl-images-amazon.com/images/G/01/lwa/dev/docs/website-developer-guide._TTH_.pdf shows samples with non-urlencides refresh token but here https://developer.amazon.com/docs/login-with-amazon/retrieve-token-other-platforms-cbl-docs.html it says they must be urlencoded.

Problems is from the error description cannot figure out what the actual reason is why the request gets rejected.

Tip: Refresh tokens contain characters that are outside the allowed range for URLs. Therefore, you should URL encode access tokens to prevent errors. For more information, see Section 2.1 of RFC3986.

Authorization endpoint used: https://www.amazon.com/ap/oa

Token endpoint used: https://api.amazon.com/auth/o2/token

0 · Share ·

debugging debugging · Jul 31, 2019 at 04:29 PM

Fixed this one. Simply did not store the original refresh token correctly.

0 · Share ·

Invalid grant type: refresh_token

question details

Related Questions