Home › Free tools › QuickBooks Online refresh token expiry checker

QuickBooks Online refresh token expiry checker

Matching pack: API Integrator for QuickBooks Online (US$24), an Agent Skill for Claude Code and Cursor with a dependency-free TypeScript client that does rotation-safe token refresh. Read its test report (19 tests against mocked Intuit HTTP, not a live sandbox company).

Hitting invalid_grant on Intuit refresh, or wondering when your QuickBooks Online tokens die? Paste a token endpoint JSON response (authorization_code or refresh_token grant), or fill the fields below. This page shows when the access token, the rolling refresh token and the optional 5-year hard cap expire — in UTC and your local time — plus a short checklist of common invalid_grant causes.

Nothing you type leaves this browser. All processing happens in this page's own JavaScript. Your inputs are not sent anywhere and not saved: the tool makes no network requests (the page's Content-Security-Policy blocks them), sets no cookies, uses no analytics and loads no third-party scripts or fonts. Once loaded, it works offline. The one request it can make is the anonymous Buy-click count on the pack card (see Privacy). Token responses can contain refresh tokens; the samples use fake eyJ…example values, and nothing is sent or stored.

Intuit token endpoint JSON response (optional if you fill the fields)

The JSON body from POST https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer. The checker reads expires_in, x_refresh_token_expires_in and optional x_refresh_token_hard_expires_in. Token strings are ignored.

When that response was received

Your local date and time when you got the response. An ISO timestamp with Z or an offset also works if you paste it into a script; this control uses local wall time.

expires_in (access token, seconds)

Usually 3600 (1 hour).

x_refresh_token_expires_in (rolling refresh, seconds)

Rolling lifetime, up to about 100 days. Each successful refresh resets it.

x_refresh_token_hard_expires_in (optional 5-year cap, seconds)

May be absent. Official Intuit OAuth clients can send request header x-include-refresh-token-hard-expires-in: true to receive it.

Samples use fake tokens like eyJ…example. Field values override the JSON when both are filled.

How QuickBooks Online tokens behave

Access token: valid for about 1 hour (expires_in, usually 3600).
Refresh token: rolling life of up to 100 days (x_refresh_token_expires_in). Each successful refresh resets the 100 days. The refresh token can rotate about once a day; always save the latest.
5-year cap: since Intuit's November 2025 policy change, refresh tokens also have a maximum life of five years. The optional field x_refresh_token_hard_expires_in is seconds left in that hard life.

Sources (plain text, not links): Intuit Developer help, "Refresh Token Expiration and Validity Policy" (help.developer.intuit.com/s/article/Validity-of-Refresh-Token); Intuit Developer blog, "Important changes to refresh token policy", 12 Nov 2025 (blogs.intuit.com/2025/11/12/important-changes-to-refresh-token-policy). Checked 27 Oct 2026.

Common causes of `invalid_grant` on refresh

Rotated token not saved. A later refresh returned a new refresh token and the previous one stopped working. Always store the latest refresh_token from every successful response.
Concurrent refresh. Two workers both refreshed the same token; one wins, the other can overwrite storage with a stale value. Use single-flight refresh per realmId.
Never persisted. The refresh succeeded but the database write failed, rolled back, or the process crashed before saving.
100-day idle. Nothing refreshed the connection for 100 days, so the rolling refresh token expired.
Revoked. The user disconnected your app in QuickBooks Online, or your code called Intuit's revoke endpoint.
Wrong app keys. A token is tied to the app keys that issued it. Development keys will not refresh a Production token.

Sources: Intuit Developer help, "Refresh Token Expiration and Validity Policy" (help.developer.intuit.com/s/article/Validity-of-Refresh-Token); Intuit Developer blog, "OAuth token management done the right way", 3 Jun 2024 (blogs.intuit.com/2024/06/03/oauth-token-management-done-the-right-way). Full write-up: QuickBooks Online refresh token returns invalid_grant. Checked 27 Oct 2026.

What this checker doesn't do

It never calls Intuit. Expiry times are computed from the numbers you paste or type.
invalid_grant means that refresh token is dead. Reconnect the user; do not retry-loop the same token.
It does not validate client IDs, secrets or realmIds, and it does not store anything.

Build rotation-safe refresh in your code

API Integrator for QuickBooks Online (US$24) is an Agent Skill for Claude Code and Cursor. It handles OAuth 2.0 with state checks and realmId, refresh tokens that rotate (kept safe with single-flight refresh), the 5-year refresh-token cap (x_refresh_token_hard_expires_in), minorversion 75, duplicate-safe creates with requestid, find-or-create customers, invoices, emailing invoices, and errors (Fault parsing, 401, 429). It was written from Intuit's 2025–26 developer docs. Its 19 automated tests use mocked Intuit HTTP, not a real sandbox company, and the multi-instance refresh lock is described in the skill but not implemented.

See API Integrator for QuickBooks Online · Read its test report · Guide: invalid_grant on refresh

QuickBooks Online refresh token expiry checker

How QuickBooks Online tokens behave

Common causes of invalid_grant on refresh

What this checker doesn't do

Common causes of `invalid_grant` on refresh