invalid_grant trying to get oAuth token from google

Although this is an old question, it seems like many still encounter it – we spent days on end tracking this down ourselves.

In the OAuth2 spec, “invalid_grant” is sort of a catch-all for all errors related to invalid/expired/revoked tokens (auth grant or refresh token).

For us, the problem was two-fold:

User has actively revoked access to our app
Makes sense, but get this: 12 hours after revocation, Google stops sending the error message in their response:
“error_description” : “Token has been revoked.”
It’s rather misleading because you’ll assume that the error message is there at all times which is not the case. You can check whether your app still has access at the apps permission page.
User has reset/recovered their Google password
In December 2015, Google changed their default behaviour so that password resets for non-Google Apps users would automatically revoke all the user’s apps refresh tokens. On revocation, the error message follows the same rule as the case before, so you’ll only get the “error_description” in the first 12 hours. There doesn’t seem to be any way of knowing whether the user manually revoked access (intentful) or it happened because of a password reset (side-effect).

Apart from those, there’s a myriad of other potential causes that could trigger the error:

I’ve written a short article summarizing each item with some debugging guidance to help find the culprit. Hope it helps.