Refresh Token issue

Developer Support APIs & Integrations
1

I have built a private API that receive messages from chat from Hubspot.

I have 2 applications sending messages to my API. Both were working fine but since a week, one app crash due to an issue with the refresh token.

When I receive a message in my API, I get a HubspotLink object which contains refreshToken=eu1-ad…b2, tokenExpire=2024-06-27T15:10:14.805Z

My working application, if the refresh token is expired go through this function:

Capture d’écran 2024-06-27 à 16.16.15.png
Capture d’écran 2024-06-27 à 16.16.15.png1242×590 142 KB

and then I have a working access token then everything goes well

My failing application has exactly the same behavior until it reach the function to get a new refresh token (see screenshot). There, it goes in the “If” and gives me “Error 400 while getting token {“status”:“BAD_REFRESH_TOKEN”,“message”:“missing or invalid refresh token”,“correlationId”:“663b9397-c63b-4809-ba4f-0599049db23b”}”

Why the refresh token is now considered as invalid ? Is there something i’m supposed to do in hubspot settings because I see nothing I can do in the code.

thanks !

2

It looks like the refresh token has been got incorrectly.

As soon as the access token expires, call the refresh token function it will update the refresh token and return a new access token.

Please see the code attached:

02974_1-1719511091183.png
02974_1-1719511091183.png782×797 111 KB

Best regards,

392×141 23.1 KB

3

It’s already what I’m doing but somehow, I have “Error 400 while getting token {“status”:“BAD_REFRESH_TOKEN”,“message”:“missing or invalid refresh token”,“correlationId”:“663b9397-c63b-4809-ba4f-0599049db23b”}”

Somehow, it seems that my application send corrupted token or something consider as invalid by the API

4

HI @himanshurauthan

@zach_threadint
Hope you’ll be able to understand our issue :

About the refresh token issue, It’s already what we’re doing but somehow, we still have “Error 400 while getting token {“status”:“BAD_REFRESH_TOKEN”,“message”:“missing or invalid refresh token”,“correlationId”:“663b9397-c63b-4809-ba4f-0599049db23b”}”

Somehow, it seems that our application send corrupted token or something consider as invalid by the API.
Really need your help please.
Regards.

5

Hi @Guyomeo :waving_hand:

Is it possible that this is a result of your app being uninstalled? To test this, I’d suggest using the GET HubSpot OAuth Refresh Token endpoint. For example:

GET https://api.hubapi.com/oauth/v1/refresh-tokens/**YOUR\_REFRESH\_TOKEN**

If you receive a 404 Not Found error response, this means you’ve made a mistake in your capture/storage/retrieval of the given refresh token, or the refresh token is no longer valid because the app has been uninstalled from the given HubSpot Portal.

I hope that proves helpful. Please let me know if you have any follow-up questions.

6

BAD_REFRESH_TOKEN in HubSpot is usually one of three things:
(1) the user uninstalled/reinstalled the app (token revoked)
(2) you’re refreshing in parallel (race condition across workers/instances)
(3) you’re using a token issued to a different app/env (mismatch/store mix-up).

This checklist covers the common root causes + what to verify (revocation vs rotation vs concurrency): https://www.nango.dev/blog/hubspot-oauth-bad-refresh-token

It has OAuth implementations for hundreds of APIs (including HubSpot) and handles token refresh, concurrency, broken token detection, etc., for you.

7

Also, using something like Nango would help you avoid these issues as Nango takes care of the token related chores like access/refresh token rotation, conucrrancy issues, secure storage for all your connections.