OAuth 2.0 error code
OAuth 2.0 error code: invalid_grant
As text you can copy
invalid_grant - Kind
- Error code
- Where you meet it
- In the error field of a reply, or in the WWW-Authenticate header
What does invalid_grant mean in OAuth 2.0?
The authorisation grant or refresh token provided is invalid, expired or revoked, does not match the redirection URI used in the authorisation request, or was issued to another client.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
What it means in trading API work
In a long running trading program this usually concerns the refresh token: it has expired or been revoked, so the program can no longer renew its access. It also appears when an authorisation code is presented too late or with a different redirection URI.
This part is this site's own explanation, written for people learning to call a trading API. It is not part of the source cited above and it describes no particular broker.
What should I do about invalid_grant?
Start the authorisation again to obtain a fresh grant. Then check that your program stores the newest refresh token it is given, and that the redirection URI matches the registered one exactly.
This page is an independent explanation in plain words. The definition itself is in the source it was read from, which is the authority if the two ever differ.