# Unknown or invalid refresh token error

**URL:** <https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975>\
**Category:** Get Help\
**Tags:** rotating-refresh-tokens, sessions\
**Created:** [August 6, 2023, 2:33pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975 "2023-08-06T14:33:10Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![vuscan.marius](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vuscan.marius/32/40937_2.png) [@vuscan.marius](https://community.auth0.com/u/vuscan.marius)\
**Post date:** [August 6, 2023, 2:33pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/1 "2023-08-06T14:33:10Z")

</div>

Hello,

Occasionally, I am getting this error:  
Status Code: 403  
{  
“error”: “invalid\_grant”,  
“error\_description”: “Unknown or invalid refresh token.”  
}

I am using the Angular SPA flow. I have enabled refresh tokens and refresh token rotation.

The error seem to appear when the server is called. The API that I have defined for the server has the offline\_access enabled.

It is probably a misconfiguration, but I can’t figure it out.

---

<div class="post-metadata">

**Author:** ![vuscan.marius](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vuscan.marius/32/40937_2.png) [@vuscan.marius](https://community.auth0.com/u/vuscan.marius)\
**Post date:** [August 30, 2023, 4:20pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/2 "2023-08-30T16:20:52Z")

</div>

The issue might have been cause by the fact that on my angular spa application configuration I had **Refresh Token Rotation Reuse Interval** set to 0.

---

<div class="post-metadata">

**Author:** ![sivanarisetty](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sivanarisetty/32/43008_2.png) [@sivanarisetty](https://community.auth0.com/u/sivanarisetty)\
**Post date:** [October 12, 2023, 8:25pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/3 "2023-10-12T20:25:35Z")

</div>

We have the same issue, were you able to find out the solution? We have **Refresh Token Rotation Reuse Interval** set to 1.

---

<div class="post-metadata">

**Author:** ![vuscan.marius](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vuscan.marius/32/40937_2.png) [@vuscan.marius](https://community.auth0.com/u/vuscan.marius)\
**Post date:** [October 13, 2023, 5:26am UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/4 "2023-10-13T05:26:17Z")

</div>

For us, this was the issue. We had it set to 432000s.

---

<div class="post-metadata">

**Author:** ![sivanarisetty](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sivanarisetty/32/43008_2.png) [@sivanarisetty](https://community.auth0.com/u/sivanarisetty)\
**Post date:** [October 13, 2023, 7:58pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/5 "2023-10-13T19:58:14Z")

</div>

We still have the issue even when we increase the Reuse Interval time to longer duration.

Even if it works, I am wondering if it is recommended. Because, we are delaying the automatic reuse detection and as per the example explained in " Refresh Token Automatic Reuse Detection" section of the blog: [What Are Refresh Tokens and How to Use Them Securely](https://auth0.com/blog/refresh-tokens-what-are-they-and-when-to-use-them/), any malicious user can still use the refresh token to get access tokens even after its first use. Please let me know if my understanding is not correct.

---

<div class="post-metadata">

**Author:** ![esmeangellada](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/esmeangellada/32/52043_2.png) [@esmeangellada](https://community.auth0.com/u/esmeangellada)\
**Post date:** [October 29, 2023, 11:58am UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/6 "2023-10-29T11:58:47Z")

</div>

Continuing the discussion from [Unknown or invalid refresh token error](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975):

---

<div class="post-metadata">

**Author:** ![jbo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jbo/32/52255_2.png) [@jbo](https://community.auth0.com/u/jbo)\
**Post date:** [November 6, 2023, 5:02pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/7 "2023-11-06T17:02:38Z")

</div>

It seems that this error appear when the refresh token has expired or has been invalidated.  
To fix this issue, I use the following code in my app.component

```auto
this._auth.error$.pipe(
      takeUntil(this._destroy$),
      filter((e) => e instanceof GenericError && (e.error === 'login_required' || e.error === 'invalid_grant')),
      mergeMap(() => this._auth.logout({
          logoutParams: {
            returnTo: '<logoutUrl>'
          }
        }))
    ).subscribe();

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [November 26, 2024, 11:48pm UTC](https://community.auth0.com/t/unknown-or-invalid-refresh-token-error/112975/8 "2024-11-26T23:48:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.