docs: document refresh invalid_grant on scope tightening

Adds integration guidance that refresh-token exchange may fail after provider-side client scope policy is narrowed.
2026-02-26 13:34:42 +00:00
parent ddc08270a7
commit 1d62f0affd
2 changed files with 2 additions and 0 deletions
@@ -139,6 +139,7 @@ try {
 `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time.
 Token introspection can return `active=false` when the token subject (user/project) or client has since been disabled.
 Provider JWT access tokens are now revocation-aware at `userinfo`; revoked JWTs can fail before natural expiry.
+Refresh-token exchange can return `invalid_grant` when provider client scope policy has been tightened and stored refresh scopes are no longer allowed.
 Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion.
 WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid.
 Existing authenticated sessions may also be invalidated when account status changes to disabled.