Failure class

n8n `400 invalid_grant` — and why it comes back every seven days

The symptom

A node that writes to Google Sheets, Gmail or Drive fails. Re-authorising the credential fixes it. About a week later it fails again, identically. Nothing in the workflow changed.

What the log shows

oauth2 → refresh access_token
← 400 {"error":"invalid_grant"}
node "Google Sheets"  ERROR
execution FAILED

The question that separates the causes

How many days pass between re-authorising and the next failure?

Exactly ~7 days, repeatedlyYour OAuth client is still in Testing publishing status in Google Cloud Console. Testing-mode refresh tokens are invalidated after seven days — every time, by design. This is invisible from inside n8n, which is why it looks like an n8n bug.

Irregular, after someone did somethingThe token was revoked centrally: a Workspace admin removed app access, a password changed, or a security review ran. Check the account's third-party access log.

Immediately, on the second useRefresh-token rotation is on and the old token was reused — usually because two workflows share one credential. Give each workflow its own.

Verdict

In the seven-day case the automation is correct and the cause is outside it. invalid_grant is the provider saying the grant is gone; n8n is reporting that accurately.

The fix

Google Cloud Console → APIs & Services → OAuth consent screen
If publishing status is Testing, click Publish app. For internal-only scopes no verification review is needed.
Re-authorise the credential in n8n once more. It will now persist.

Hardening

Add an error branch on the node that alerts specifically on invalid_grant. The next occurrence then becomes a notification rather than silent data loss.

Re-authorising without publishing the consent screen treats the symptom weekly, forever. That is the trap: the fix appears to work every single time.

Still not it?

Send the workflow export and the execution log of one failing run. Within 24 hours you get a written diagnosis: the exact line in your own log that caused it, the fix in your own UI, and a corrected workflow file you import yourself. No account access, no credentials, no call. If the artifacts do not contain the answer, the report says so and it is refunded.

Send an autopsy request →

Or write to hello@workflowautopsy.com.

n8n 400 invalid_grant — and why it comes back every seven days