Intermittent invalid_grant Errors on Mobile Devices Using Okta Native Single Sign-On
Last Updated:
Overview
When using Okta Native Single Sign-On (SSO), mobile applications may experience intermittent invalid_grant errors. This occurs because the device_sso scope binds the refresh token to the Okta session, meaning Okta invalidates the token when the session ends.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Native Single Sign-On (SSO)
- Mobile Applications
Cause
The device_sso scope binds the refresh token directly to the Okta session. When the Okta session ends or expires on the mobile device, Okta automatically invalidates the associated refresh token. Subsequent attempts to use the invalidated refresh token result in an invalid_grant error.
Solution
Why do intermittent invalid_grant errors occur with the device_sso scope?
The device_sso scope binds the refresh token to the Okta session. This design ensures that when the Okta session terminates, Okta immediately invalidates the refresh token. This behavior surfaces as the following intermittent error in mobile applications when the application attempts to use a refresh token tied to an expired or terminated session:
invalid_grant
This is expected behavior. The application must establish a new session to resolve the error.
