I have developed an OAuth client and obtained a refresh token from users upon their authorization of my OAuth client.
In a post on the HubSpot Community (https://community.hubspot.com/t5/APIs-Integrations/Does-the-OAuth-refresh-token-expire/m-p/335543#M32616), it was stated that refresh tokens never expire unless the user uninstalls the app.
However, we have encountered situations where attempting to use a user’s refresh token to generate an access token through the HubSpot Python SDK resulted in a ‘BAD REFRESH TOKEN’ error. This error persists even when the user has not uninstalled the app.
It seems that the HubSpot system might be revoking the refresh token. This leads to the question: is this behavior indicative of an issue with the HubSpot system? If so, could you provide clarification on when a refresh token is revoked, apart from cases involving app uninstallation?
Hey @DanhNguyen22,
You are correct - refresh tokens should never expire unless as you’ve stated someone uninstalls the app. In that case they’re invalidated and one has to go through the auth process to obtain new tokens.
Was there a time that this ever worked for you? The reason I ask is I wonder if perhaps there is some sort of issue with the request to refresh the token itself. I’m sure you’ve already debugged this but I’d just double check to ensure the body of the request is formatted correctly.
Another thing that might be worth trying (to see if the issue is isolated to the Python SDK and/or your code) is to attempt to refresh the token using postman.
Thank you for your prompt response!
Regarding the query: ‘Was there a time that this ever worked for you?’ – Yes, it has typically been functioning well for us. We’ve been able to successfully use the user’s refresh token to generate an access token using the Python SDK available at GitHub - HubSpot/hubspot-api-python: HubSpot API Python Client Libraries for V3 version of the API · GitHub.
While everything functions correctly with the same code and SDK most of the time, there are instances where we encounter the above-mentioned issue. I’m certain that the request’s body is properly formatted.
It’s puzzling that if the Python SDK were the issue, it should consistently fail, rather than intermittently like this.
I believe there might be a similar issue documented here: https://community.hubspot.com/t5/APIs-Integrations/Refresh-Token-stops-working-suddently/td-p/671442, which seems to be unresolved.
If needed, I’m more than willing to provide additional information. I can also share the CURL command for the ‘BAD refresh token’ issue (where the user hasn’t uninstalled the app) for your convenience in troubleshooting
Hi @coldrickjack , I hope you’ve had a chance to read my message. Could you provide any updates on the status of this issue? Besides, our company (Credify) has Bee Next as our investor.
Hi @DanhNguyen22,
I have seen your message but I should mention I don’t actually work for HubSpot! 
I contribute to this community in an extra curricular capacity when I have free time like many of the other contributers.
With that said, it’s definitely unusual the behaviour that you are experiencing. Out of curiosity did you try to obtain a new access token using an external tool like Postman?