A Google integration usually stops because its refresh token was invalidated. Google documents five causes: the user revoked access, the token went unused for six months, a password change with Gmail scopes, too many live tokens for the account, or a test-mode app with a seven day token. Reconnect, then fix the cause.
Definitions
An access token is the short-lived credential an integration presents on each call. A refresh token is the longer-lived credential it uses to get new access tokens without asking you to sign in again. When the refresh token dies, the integration cannot get new access tokens, and the automation fails with an authorization error.
The five documented causes
| Cause | What it means | Fix |
|---|---|---|
| Access revoked | The user removed the app in account settings | Reconnect, and ask why it was removed |
| Six months unused | The token was not used for six months | Reconnect, and consider whether the job is still needed |
| Password change with Gmail scopes | The user changed passwords and the token holds Gmail scopes | Reconnect after password changes |
| Token limit | The account exceeded the maximum number of live refresh tokens | Remove stale grants, then reconnect |
| Testing status | An external app in "Testing" status gets tokens that expire after 7 days | Move the app out of testing, or accept re-consent weekly |
The testing exception does not apply when the only scopes are the basic profile ones (email, profile and openid), according to Google's documentation.
Diagnose in order
- Read the error. An invalid grant message points to the token, not to your code.
- Ask who owns the connection. Many automations run on one person's grant, so a leaver or a password reset can break the job.
- Check the connected apps list for the account and look for the app. If it is missing, someone revoked it.
- Check the last successful run. A gap near six months explains inactivity.
- If you built the app, check its publishing status in the cloud console.
Fix it so it stays fixed
Do not just click reconnect and move on. Each cause points at a design choice.
- A job tied to one employee's account will fail when that person leaves. Use a dedicated account for the integration, with a named owner and a backup owner.
- Seasonal jobs, such as a yearly export, will hit the six month rule. Schedule a harmless call in between, or reconnect on a calendar.
- If password resets break the integration, document a step to reconnect after a reset.
- Monitor for authorization failures and alert on them, so you learn about it the same day.
Is a dying token a security feature?
Partly. Expiry limits how long a stolen token is useful, and revocation lets a user cut off an app. These are reasons to keep scopes small and to prefer tokens that expire over ones that live forever. Treat a failure as a prompt to review the grant, not just to restore it.
Quick check
Is a refresh token the same as an API key?
No. A refresh token is issued after a user consents, is tied to that user and a set of scopes, and can be revoked by the user. An API key is a static secret that identifies a project.
Should I store refresh tokens in my automation tool?
Only in the tool's secure credential storage, encrypted at rest. Google advises storing tokens securely and never transmitting them in plain text.
Safeguard's asset discovery can help you list the systems that connect to your accounts. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
