# Refresh Token issue **URL:** \ **Category:** APIs & Integrations\ **Tags:** oauth\ **Created:** [June 27, 2024, 3:10pm UTC](https://community.hubspot.com/t/refresh-token-issue/110266 "2024-06-27T15:10:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![RMelliti](https://avatars.discourse-cdn.com/v4/letter/r/3e96dc/32.png) [@RMelliti](https://community.hubspot.com/u/RMelliti)\ **Post date:** [June 27, 2024, 3:10pm UTC](https://community.hubspot.com/t/refresh-token-issue/110266/1 "2024-06-27T15:10:14Z")
I have built a private API that receive messages from chat from Hubspot. I have 2 applications sending messages to my API. Both were working fine but since a week, one app crash due to an issue with the refresh token. When I receive a message in my API, I get a HubspotLink object which contains refreshToken=eu1-ad…b2, tokenExpire=2024-06-27T15:10:14.805Z My working application, if the refresh token is expired go through this function: ![Capture d’écran 2024-06-27 à 16.16.15.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/7/3/730dfb91ecccac263295d8bc9d70090da58e1bfb.png) and then I have a working access token then everything goes well My failing application has exactly the same behavior until it reach the function to get a new refresh token (see screenshot). There, it goes in the “If” and gives me “Error 400 while getting token {“status”:“BAD\_REFRESH\_TOKEN”,“message”:“missing or invalid refresh token”,“correlationId”:“663b9397-c63b-4809-ba4f-0599049db23b”}” Why the refresh token is now considered as invalid ? Is there something i’m supposed to do in hubspot settings because I see nothing I can do in the code. thanks ! ---
**Author:** ![AddaxLab](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/addaxlab/32/26380_2.png) [@AddaxLab](https://community.hubspot.com/u/AddaxLab)\ **Post date:** [June 27, 2024, 5:59pm UTC](https://community.hubspot.com/t/refresh-token-issue/110266/2 "2024-06-27T17:59:09Z")
It looks like the refresh token has been got incorrectly. As soon as the access token expires, call the refresh token function it will update the refresh token and return a new access token. Please see the code attached: ![02974_1-1719511091183.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/4/3/43b6a8fec949174a85f3689b0cabb3d57e8fa1fc.png) Best regards, ![](https://d2qpr2jzcazej7.cloudfront.net/original/3X/a/4/a47b98fe68635988fb8f08999a318bd012dac7b3.png) ---
**Author:** ![RMelliti](https://avatars.discourse-cdn.com/v4/letter/r/3e96dc/32.png) [@RMelliti](https://community.hubspot.com/u/RMelliti)\ **Post date:** [July 10, 2024, 9:48am UTC](https://community.hubspot.com/t/refresh-token-issue/110266/3 "2024-07-10T09:48:21Z")
It’s already what I’m doing but somehow, I have “Error 400 while getting token {“status”:“BAD\_REFRESH\_TOKEN”,“message”:“missing or invalid refresh token”,“correlationId”:“663b9397-c63b-4809-ba4f-0599049db23b”}” Somehow, it seems that my application send corrupted token or something consider as invalid by the API ---
**Author:** ![Guyomeo](https://avatars.discourse-cdn.com/v4/letter/g/51bf81/32.png) [@Guyomeo](https://community.hubspot.com/u/Guyomeo)\ **Post date:** [September 26, 2024, 7:56am UTC](https://community.hubspot.com/t/refresh-token-issue/110266/4 "2024-09-26T07:56:57Z")
HI @himanshurauthan [@zach\_threadint](https://community.hubspot.com/t5/user/viewprofilepage/user-id/324811) Hope you’ll be able to understand our issue : About the refresh token issue, It’s already what we’re doing but somehow, we still have “Error 400 while getting token {“status”:“BAD\_REFRESH\_TOKEN”,“message”:“missing or invalid refresh token”,“correlationId”:“663b9397-c63b-4809-ba4f-0599049db23b”}” Somehow, it seems that our application send corrupted token or something consider as invalid by the API. Really need your help please. Regards. ---
**Author:** ![zach\_threadint](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/zach_threadint/32/46318_2.png) [@zach\_threadint](https://community.hubspot.com/u/zach_threadint)\ **Post date:** [September 29, 2024, 2:01am UTC](https://community.hubspot.com/t/refresh-token-issue/110266/5 "2024-09-29T02:01:50Z")
Hi @Guyomeo 👋 Is it possible that this is a result of your app being uninstalled? To test this, I’d suggest using the GET HubSpot OAuth Refresh Token endpoint. For example: **GET** [https://api.hubapi.com/oauth/v1/refresh-tokens/\*\*YOUR\_REFRESH\_TOKEN](https://api.hubapi.com/oauth/v1/refresh-tokens/**YOUR%5C_REFRESH%5C_TOKEN)\*\* If you receive a 404 Not Found error response, this means you’ve made a mistake in your capture/storage/retrieval of the given refresh token, or the refresh token is no longer valid because the app has been uninstalled from the given HubSpot Portal. I hope that proves helpful. Please let me know if you have any follow-up questions. ---
**Author:** ![OA0023](https://avatars.discourse-cdn.com/v4/letter/o/f9ae1b/32.png) [@OA0023](https://community.hubspot.com/u/OA0023)\ **Post date:** [January 22, 2026, 11:09pm UTC](https://community.hubspot.com/t/refresh-token-issue/110266/6 "2026-01-22T23:09:46Z")
BAD\_REFRESH\_TOKEN in HubSpot is usually one of three things: **(1)** the user uninstalled/reinstalled the app (token revoked) **(2)** you’re refreshing in parallel (race condition across workers/instances) **(3)** you’re using a token issued to a different app/env (mismatch/store mix-up). This checklist covers the common root causes + what to verify (revocation vs rotation vs concurrency): [https://www.nango.dev/blog/hubspot-oauth-bad-refresh-token](https://www.nango.dev/blog/hubspot-oauth-bad-refresh-token?utm_source=chatgpt.com) It has OAuth implementations for hundreds of APIs (including HubSpot) and handles token refresh, concurrency, broken token detection, etc., for you. ---
**Author:** ![snake85](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@snake85](https://community.hubspot.com/u/snake85)\ **Post date:** [May 15, 2026, 11:37pm UTC](https://community.hubspot.com/t/refresh-token-issue/110266/7 "2026-05-15T23:37:29Z")
Also, using something like Nango would help you avoid these issues as Nango takes care of the token related chores like access/refresh token rotation, conucrrancy issues, secure storage for all your connections.