I am getting invalid refresh token for one specific user. For other users, it's working fine. Why?

[Nitesh Chandel]

I have many users with using our OAuth consumer, but for one specific user I am getting Invalid refresh_token, but there was nothing different about the way we have done it for that user. Please let me know what can be the possible reason?

[Patrik S · Accepted solution]

Hello @Nitesh Chandel ,

Welcome to Atlassian Community!

The refresh_token doesn't really have an expiration. The only way a refresh_token would become invalid is if the scope of the OAuth Consumer was edited, or if the OAuth consumer was deleted.

If the OAuth consumer was edited a new refresh token will be generated, and the previous refresh token as well as any previous access token will be revoked and cannot be used anymore.

With that in mind, I would like to ask the following :

• Is the user with the failing request using the exact same refresh token as the user that got a successful request?
• Was there any change in the OAuth Consumer during this time that might have caused the refresh token to change? 
• What is the exact command/API call the user is using to get a new access token using the refresh token? 

Thank you, @Nitesh Chandel !

Patrik S