Meet the new Scripe, live on October 7.Register

API v1 · OAuth

invalid_grant

HTTPWhen
400The authorization grant or refresh token is invalid, expired, or revoked.

Returned by the token endpoint when the presented grant cannot be exchanged:

  • The authorization code expired (10-minute TTL), was already used (single-use), or was issued to a different client_id / redirect_uri.
  • The PKCE code_verifier doesn't match the code_challenge sent to /authorize.
  • The refresh token is expired, revoked, or belongs to a revoked family.

To recover, restart the flow at /authorize — do not retry the exchange with the same grant. See OAuth §3–4.