Google Analytics Flow error: Login failed, status code 400 (Token expired)

Question

Hi all,  
  
My team has successfully created a flow moving data in JSON format from Google Analytics to an S3 bucket. However, after a few days, it has failed throwing this error:  
  
**Login failed with status code 400: { "error": "invalid_grant", "error_description": "Token has been expired or revoked." }**   
  
It seems to be a connector issue due to the token expiring because we have created a new Appflow connection using the exact same client id and client secret, assigned this new connection to the flow, and it worked as usual. (We expect it to fail again after a few days)  
  
Can this token be refreshed automatically from Google's side? If possible, how do we do this in the Appflow connection? If not, what are possible solutions? I am looking into CloudFormation as our last resort but didn't want to dive in yet if the issue has an easier fix.  
  
Thanks for the help!

Answer

This occurs when you are authenticating via a Google Cloud OAuth consent screen which is in 'Testing' mode. To prevent the token from expiring after 7 days you need to add your Google Cloud project to the Google Cloud organization linked to your company's domain name and then publish the OAuth consent screen as 'Internal'. This enables any user with an e-mail address in your company's domain to authenticate via your OAuth app, provided that user has first been added to the Google Workspace or Google Cloud Identity organization, and they are also a user in Analytics 360. We managed to get it working using these instructions:

Migrating a project into an organization

Publishing an internal app

[Migrating a project into an organization](https://cloud.google.com/resource-manager/docs/project-migration#migrating_projects_no_org)

[Publishing an internal app](https://support.google.com/cloud/answer/10311615?hl=en#zippy=%2Cinternal)

Answer

Duplicate

Google Analytics Flow error: Login failed, status code 400 (Token expired)

Relevant content