Google OAuth error

General
1

Hi everyone,

One of our clients tried to log in using Google but encountered the following error:
Code: 3109 Error during obtaining of access token. Response from OAuth2 provider server: Bad Request { “error”: “invalid_grant”, “error_description”: “Bad Request” }

image
image1917×193 23.9 KB

image
image484×280 17.6 KB

Could you please help investigate and advise on a resolution?

App ID:4A47197B-AE30-FA84-FF56-0071F4010900

Thank you!

2

Hello @Francis_Bagas

Thank you for reporting this issue. The invalid_grant error typically occurs due to a temporary hiccup in the authorization exchange process between our servers and Google (e.g., an expired or accidentally duplicated authorization code).

We have escalated this to our team, and they will look into the issue to find out what went wrong.

In the meantime, could you or your client please try the following quick troubleshooting steps?

  1. Clear the browser cache and cookies, or try logging in via an Incognito/Private browsing window.
  2. Ensure that you only click the “Login with Google” button once, as double-clicking can sometimes invalidate the login code.

If the issue persists after trying this, please let us know. We will update you as soon as our team have more information!

Best regards,
Viktor

4

Hello @Francis_Bagas

Thank you for reporting this issue. We investigated the error.

What happened:

The invalid_grant error from Google can occur for several reasons, but the most likely explanation in this case is that the same authorization code was sent to the server more than once. Google’s authorization codes are strictly
single-use — once a code is exchanged for an access token, any subsequent attempt to use the same code will be rejected with this error.

This typically happens when:

  • The user refreshes the browser page (F5) after the Google redirect
  • The login button is clicked more than once
  • Client-side retry logic re-sends the callback request

In any of these cases, the first request would succeed normally, but the second request would attempt to exchange the same code with Google and receive invalid_grant.

Recommendation:

Please ensure the OAuth callback is not being triggered multiple times. Preventing duplicate requests should resolve this issue.

Let us know if you have any further questions.

Regards,
Volodymyr