invalid_refresh_token

HTTP status: 401 · Code: invalid_refresh_token

The refresh token is malformed, reused, or its session has ended or expired; sign in again.

Why it happens

The refresh token is malformed, was already used, or its session has ended or expired. A refresh token works once; using an old one again also ends the session, in case it was stolen.

How to fix

Sign the user in again. If you see this often, check that two places in your app aren’t refreshing the same session at once with the same token. The SDKs coordinate refreshes for you.

Catch it in your code

Every SDK throws one error type for a failed call. Match on its code, which is always invalid_refresh_token for this error, never on the message.

JavaScript and Next.js

import { ErrorCode, OrvanoError } from '@orvano/js'

try {
  // your Orvano call
} catch (error) {
  if (error instanceof OrvanoError && error.code === ErrorCode.invalidRefreshToken) {
    // handle invalid_refresh_token
  } else {
    throw error
  }
}

Dart and Flutter

import 'package:orvano_flutter/orvano_flutter.dart'; // or orvano_dart on a server

try {
  // your Orvano call
} on OrvanoException catch (error) {
  if (error.code != ErrorCode.invalidRefreshToken) rethrow;
  // handle invalid_refresh_token
}

.NET

using Orvano;

try
{
    // your Orvano call
}
catch (OrvanoException error) when (error.Code == ErrorCode.InvalidRefreshToken)
{
    // handle invalid_refresh_token
}

The error also carries the HTTP status (401), a message, and a request ID. Quote the request ID when you report a problem: the server logs it with the failure. See Errors for how errors work in every SDK, or every error code.