# Invalid access token returned when using refresh token **URL:** \ **Category:** Get Help\ **Tags:** rotating-refresh-tokens, sessions\ **Created:** [October 7, 2024, 4:15am UTC](https://community.auth0.com/t/invalid-access-token-returned-when-using-refresh-token/148742 "2024-10-07T04:15:48Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![alan.stead](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alan.stead/32/61134_2.png) [@alan.stead](https://community.auth0.com/u/alan.stead)\ **Post date:** [October 7, 2024, 4:15am UTC](https://community.auth0.com/t/invalid-access-token-returned-when-using-refresh-token/148742/1 "2024-10-07T04:15:48Z")
Ready to post? 🔍 First, try searching for your answer. I’ve got a react app with a nodejs backend and a cloud database. I’m new to auth0 to trying to get it all setup. I had simple user authentication setup using the react API no problem. Now I’m trying to use refresh tokens with shorter access token expiration times, to hopefully make it more secure. I have middleware that checks the expiration date of the authorization access token coming into my axios calls. If they are expired I was planning to use the refresh token to get new access tokens. I can use the refresh token from my database to get new tokens as follows: tokenData: { access\_token: ‘…’, refresh\_token: ‘…’, id\_token: ‘…’, scope: ‘openid profile offline\_access’, expired\_in: xxxx, token\_type: ‘Bearer’ } I store the new refresh token in my database and try to replace the authorization access token in the axios header with the new one: req.headers.authorization = `Bearer ${newTokens.access_token}`; And was hoping everything would continue, however it appears the access token I receive back is malformed, or it might be a JWE (encrypted) toke? Either way, when I try and use it as is, I get errors saying it is an invalid token. Any help is appreciated! ---
**Author:** ![alan.stead](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alan.stead/32/61134_2.png) [@alan.stead](https://community.auth0.com/u/alan.stead)\ **Post date:** [October 7, 2024, 4:45pm UTC](https://community.auth0.com/t/invalid-access-token-returned-when-using-refresh-token/148742/3 "2024-10-07T16:45:14Z")
To make sure my configuration is clear: ```auto ``` Here is my client side call to authorize when I hit the login button, it includes the code challenge and setting the scope to include offline\_access: ```auto 'https://'+ auth0data.domain + '/authorize?' + 'response_type=code&' + 'client_id='+ auth0data.clientId + '&' + 'redirect_uri='+ auth0data.redirectURL + '&' + 'code_challenge='+ codeChallenge + '&' + 'code_challenge_method=S256&' + 'scope=offline_access openid profile'; ``` My callback captures the authorization code and sends it to the back end, along with the code verifier. const params = new URLSearchParams(location.search); const authorizationCode = params.get(‘code’); const response = await axios.post(baseUrl + channels.AUTH0\_GET\_TOKENS, { authorizationCode: authorizationCode, codeVerifier: codeVerifier }); Back end then makes the call to get the tokens: ```auto const tokenResponse = await `https://${process.env.REACT_APP_AUTH0_DOMAIN}/oauth/token`, { headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ grant_type: 'authorization_code', client_id: process.env.REACT_APP_AUTH0_CLIENT_ID, client_secret: process.env.REACT_APP_AUTH0_CLIENT_SECRET, code: authorizationCode, redirect_uri: process.env.REACT_APP_AUTH0_CALLBACK_URL, code_verifier: codeVerifier, }), } ``` I wasn’t sure how to store the access token back on the client side. So once the back end returns back to the client side, I was setting the client side authentication as follows. This seems to work, but I’m sure there is a better way. ```auto loginWithRedirect({ authorizationParams: { response_type: 'token', client_id: auth0data.clientId, redirect_uri: `${window.location.origin}`, audience: auth0data.audience, scope: 'read:current_user', }, }); ``` When I detect that an access token has expired, I ```auto `https://${process.env.REACT_APP_AUTH0_DOMAIN}/oauth/token`, { grant_type: 'refresh_token', client_id: process.env.REACT_APP_AUTH0_CLIENT_ID, client_secret: process.env.REACT_APP_AUTH0_CLIENT_SECRET, refresh_token: refreshToken, } ``` ---
**Author:** ![marcstedman](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcstedman/32/71118_2.png) [@marcstedman](https://community.auth0.com/u/marcstedman)\ **Post date:** [March 20, 2025, 2:05am UTC](https://community.auth0.com/t/invalid-access-token-returned-when-using-refresh-token/148742/4 "2025-03-20T02:05:33Z")
Just FYI, I found a solution and posted here: > [@Trouble with authorizing my own backend api invalid token error](https://community.auth0.com/t/trouble-with-authorizing-my-own-backend-api-invalid-token-error/136409/5): > > Regarding the InvalidTokenError: Invalid Compact JWS error many are experiencing. I spent a couple hours trying to figure out this same problem. There are many posts in the forum suggesting to add the audience param to the \ component in React-Native. This does not work. After digging deep into the useAuth0() hook package and types, I found that you can pass the audience param to the authorize() call when initiating the login flow: await authorize({ audience: 'SAME-A… ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [April 30, 2025, 12:34pm UTC](https://community.auth0.com/t/invalid-access-token-returned-when-using-refresh-token/148742/5 "2025-04-30T12:34:20Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.