refresh_token grant returns invalid_grant ("issued to another client") for sell.fulfillment scope
Summary: tddh-90 is encountering an error while trying to obtain an access token using the OAuth2 refresh_token grant for the Sell Fulfillment API, receiving an 'invalid_grant' error. They have checked their Client ID and credentials, and correctly obtained the refresh token multiple times. developer-support@ebay.com from eBay Developers Support suggests that this error might be due to the token being expired, revoked, or incorrectly encoded. They recommend ensuring no changes have occurred to the eBay account and to attempt the consent-request flow again. If issues persist, submitting a support ticket with request details is advised.
Hello,
I'm trying to obtain an access token using the OAuth2 refresh_token grant for the Sell Fulfillment API (sell.fulfillment scope), but I consistently receive the following error:
POST https://api.ebay.com/identity/v1/oauth2/token
Response: 400
{"error":"invalid_grant","error_description":"the provided authorization refresh token is invalid or was issued to another client"}
Details:
- Production App ID (Client ID): taramada-rannrann-PRD-10acd91f7-09b9fb5f
- I confirmed the Client ID/Cert ID pair is valid, since a client_credentials-style call via the API Explorer (Browse API) succeeds with this same keyset.
- I obtained the refresh token multiple times via the "User Tokens" page (Get A User Token via Your Application, OAuth radio button) under this exact Production keyset, completed the consent screen ("Review and Grant Application Access") which listed sell.fulfillment permissions, and copied the token immediately after consent.
- Despite this, every refresh_token exchange attempt returns invalid_grant with the "issued to another client" message.
Could someone help me confirm:
1. Whether this application/keyset has been approved for Sell API (sell.fulfillment) access in Production, or if further approval is required.
2. Whether there is a mismatch between the RuName used for consent and this App ID/Cert ID pair.
Thank you for your help.
developer-support@ebay.com
Hi @tddh-90 ,
Thank you for your post!
We would like to inform you that the error message with the description "the provided authorization refresh token is invalid or was issued to another client" typically indicates that the refresh token you are using is either incorrect, expired, or has been revoked. Here are the key points regarding scenarios where a refresh token can become invalid or expire:
1. Token Expiry: Refresh tokens have a specific lifespan, generally 18 months. If the token has expired, they will need to go through the OAuth linking process again to obtain a new refresh token.
2. Revocation Due to Account Changes: Any changes to the eBay account, such as altering the eBay member log-in name or changing password, will automatically revoke any active refresh tokens associated with that account. Although it's mentioned that the password hasn't changed, it's worth checking if there have been any changes to the eBay account settings or permissions.
3. Incorrectly Encoded Credentials: When making requests to obtain or refresh tokens, ensure that your client credentials (Client ID and Client Secret) are correctly encoded. The credentials must be base64 encoded and included in the Authorization header of the request. If the encoding is incorrect, or if the Authorization header is improperly formatted, it can lead to an "invalid_grant" error.
If your application falls under any of these scenarios, it is advisable to redo the consent-request flow in order to get a new access token and refresh token for the associated user.
If you continue to experience the issue, we kindly ask that you submit a support ticket through the eBay Support Tickets page. Please include the request/response details along with the rlogId. This complimentary service will enable us to investigate the issue more thoroughly.
Best Regards,
eBay Developers Support
tddh-90
OPJul 10, 2026 at 11:51 PMThank you for the detailed explanation. I have redone the consent flow multiple times with the same Production App ID/Cert ID (taramada-rannrann-PRD-10acd91f7-09b9fb5f), confirmed via API Explorer that this Client ID/Cert ID pair works correctly for OAuth, and the Authorization header is correctly Base64-encoded. However, I still get the same error on every attempt.
Here are the details from my latest attempt:
Request:
POST https://api.ebay.com/identity/v1/oauth2/token
Authorization: Basic (Base64 of Client ID:Cert ID for taramada-rannrann-PRD-10acd91f7-09b9fb5f)
Body: grant_type=refresh_token&refresh_token=<token>&scope=https://api.ebay.com/oauth/api_scope/sell.fulfillment
Response:
Status: 400
{"error":"invalid_grant","error_description":"the provided authorization refresh token is invalid or was issued to another client"}
rlogId: t6ldssk67dlkr%3D9jgrwm56%60jhs.0%3F%3E5fd05%3C%3F*w%60ut262*wbkcs-19f4e6365d9-0x2360
I could not find a "New Ticket" button on the Developer Technical Support "My Tickets" page to submit this separately, so I'm following up here. Could you please investigate this rlogId?
Thank you.