Stop QuickBooks invalid_grant after a token refresh
If QuickBooks Online works for a day then fails with invalid_grant, check your refresh tokens.
Intuit refresh tokens can rotate on refresh, about every 24 to 26 hours. Once a new one is issued, the old one is dead. So:
1. Save the refresh_token from every refresh response, not just the first one, keyed by realmId. 2. Refresh once per company at a time. Share one in-flight refresh per realm (add a DB or Redis lock across instances). 3. Don't retry invalid_grant in a loop. Mark the connection disconnected and send the user through OAuth again.
API Integrator for QuickBooks Online (US$24) gives Claude Code and Cursor a token manager that saves every rotated refresh token and shares one in-flight refresh per realm in-process (add your own DB or Redis lock across instances), with tests against mocked Intuit HTTP.