access_denied during token refresh

Follow

New post

bocks2k

• January 30, 2019 14:08

I'm attempting to refresh an access token via https://api.box.com/oauth2/token endpoint (via Boxr gem for Ruby), with grant_type=refresh_token, and client and secret included.  For one token, I'm getting an error that doesn't appear documented and is pretty vague:

It's HTTP status 403, with  {"error":"access_denied","error_description":"Access denied"}.  403's listed on https://developer.box.com/docs/error-codes don't include this possibility.  I'm stumped as to what the reason could be.  Other connections using the same client id and secret, before and after this attempt, result in success (or "invalid_grant" errors).  Any thoughts or documentation I might be missing?

 

Thanks in advance for any help.

0

• 

  cbetta

  • February 01, 2019 09:28

   did it give you any request ID?

  0

  Comment actions Permalink
• 

  bocks2k

  • February 07, 2019 09:02

   I'm afraid I didn't catch any request id at the time of the issue (not 100% sure the underlying gem exposes this).  I will say, I think I sorted out the problem - it looks like the refresh token was old and no longer valid.  Would this match expectations for that situation?

   

  Thanks.

  0

  Comment actions Permalink
• 

  cbetta

  • February 07, 2019 09:15

  Refresh tokens should not expire naturally unless the application was changed/revoked. But yes that would make sense.

  0

  Comment actions Permalink

Please sign in to leave a comment.