Error: invalid_client, Description: Client authentication failed.

Question

Why is our Bing Webmaster API integration, which was working flawlessly for 2 months using OAuth 2.0 authorization code flow with refresh tokens, suddenly failing with "invalid_grant: Refresh token does not match client" error?

Our application follows standard OAuth implementation:

Properly configured Azure App Registration with Bing Webmaster API permissions

Using https://login.microsoftonline.com/common/oauth2/v2.0/token endpoint

Previously valid refresh tokens now return "does not match client" error

Reauthentication attempts fail with "invalid_grant: Request is malformed or invalid" (AADSTS9002313)

Client credentials unchanged, no configuration modifications made

What could cause previously valid refresh tokens to become orphaned? Is this a known service issue or security policy change?

Answer 1

The error message "invalid_grant: Refresh token does not match client" typically indicates that the refresh token you are using is not associated with the client application that is making the request. Here are some potential reasons why this might occur:

1. Client ID Mismatch: If the refresh token was issued to a different client ID than the one currently being used, it will result in this error. Ensure that the client ID used in the token request matches the one associated with the refresh token.
2. Token Expiration or Revocation: Refresh tokens can be invalidated at any time. If the user has changed their password, removed permissions for your application, or if the refresh token has expired, you may encounter this error. The OAuth specification allows for refresh tokens to be revoked by the authorization server without prior notice.
3. Public vs. Confidential Clients: If you are using a public client application (without a client secret), the refresh token may only be valid on the device it was issued. If you attempt to use it from a different device or context, it may lead to this error.
4. Configuration Changes: Although you mentioned no configuration changes were made, double-check that the Azure App Registration settings have not been altered, including permissions and redirect URIs.
5. Service Issues or Policy Changes: Occasionally, service issues or changes in security policies by Microsoft could affect the validity of tokens. If there have been recent updates or announcements regarding the Bing Webmaster API or Microsoft identity platform, they could provide insights into this issue.

To resolve the issue, you might need to prompt the user to re-authenticate to obtain a new refresh token and ensure that the application is correctly configured to handle the OAuth flow.

---

References:

• Get access and refresh tokens
• Common OAuth errors