Question: Refresh Token Expiry?

OpenEMR Development
1

So is there an expiry time for the refresh token? I know that the access tokens expire in 1 hour but the for the refresh token, there seems to be no expiry time but im getting this error:

{“error”:“invalid_request”,“error_description”:“The refresh token is invalid.”,“hint”:“Cannot decrypt the refresh token”,“message”:“The refresh token is invalid.”}

2

Yes, refresh tokens do expire — even though they typically have a longer lifespan than access tokens. The error you’re encountering:

{“error”:“invalid_request”,“error_description”:“The refresh token is invalid.”,“hint”:“Cannot decrypt the refresh token”,“message”:“The refresh token is invalid.”}

indicates a problem not just with expiration, but possibly with decryption or corruption of the refresh token.

Shape

:mag: Breakdown of the Error

“Cannot decrypt the refresh token”: This means the token is either corrupted, manipulated, or was encrypted using a key that is no longer valid (e.g., rotated).

“The refresh token is invalid.”: This is a fallback message when the server can’t validate or decrypt the token.

Shape

:white_check_mark: Possible Causes & Fixes

  1. :closed_lock_with_key: Key Rotation / Token Encryption Key Changed

If the encryption key used to sign or encrypt the refresh token was changed on the server (e.g., during a deployment or configuration update), then any previously issued tokens would be undecryptable.

Fix: Make sure your server uses a consistent secret key or keystore to encrypt/decrypt tokens. If you’re using something like JWT or OAuth2, verify that the signing/encryption key hasn’t changed.

Shape

  1. :clock3: Refresh Token Expired

Even if not explicitly stated, refresh tokens often do expire after a certain period of inactivity or fixed time (e.g., 7 days, 30 days).

Fix: Check the token issuance server (e.g., OAuth2 provider, identity service) for the refresh token expiry policy.

Shape

  1. :arrows_counterclockwise: Refresh Token Was Already Used / Rotated

Some systems implement refresh token rotation, where each token can be used only once, and a new one is issued every time you refresh.

Fix: Ensure you’re saving and using the new refresh token that comes with each successful refresh response.

Shape

  1. :receipt: Token Format Invalid or Corrupted

If the token was manually edited, truncated, or malformed, decryption will fail.

Fix: Verify the refresh token is being sent as-is and hasn’t been altered (e.g., in transmission or storage). Check your logs for the original token and compare with the one being submitted.

Shape

  1. :soap: Client Sending Wrong Token

Sometimes, the wrong token might be picked up from local storage, cache, or cookies.

Fix: Clear local storage/cookies and re-authenticate to get a new refresh token.

Shape

:repeat: Solution Flow

:x: Getting invalid_request with Cannot decrypt the refresh token

:white_check_mark: Try to re-authenticate and obtain new access and refresh tokens

:brain: Log and compare both old and new tokens

:closed_lock_with_key: Ensure consistent encryption keys on server across deployments

:man_detective: Investigate your identity/auth server for refresh token lifetime settings and rotation policies

If you face any difficulties on this, you can access our free support with our experts.

1 Like
3

Refresh Tokens are good for 3 months. Your dealing with a bad id, not an expiration as mentioned by @Qiaben

1 Like
4

Thank you very much.