How a Race Condition Between Workers Triggers OAuth invalid_grant Errors

A common but misunderstood cause of OAuth 'invalid_grant' errors is not clock skew or expired credentials, but two backend workers simultaneously submitting the same refresh token to a provider. When providers rotate refresh tokens, the second request presents an already-consumed token, which many providers treat as a replay attack and revoke the entire token family. This forces users to manually reconnect their accounts rather than allowing a simple retry. The recommended fix is to serialize token refresh operations using a single-flight mechanism, such as PostgreSQL advisory locks, so only one worker refreshes a given token at a time. Since refresh-token rotation is now standard practice under OAuth 2.0 security guidelines and expected in OAuth 2.1, developers should design integrations to treat every token refresh as a state mutation requiring coordination.