Token must be a short-lived token and in a reasonable timeframe

Question

I am having the same error as this. In my case it is happening when the app is trying to upload a file via Google Cloud Client API.

POST https://www.googleapis.com/oauth2/v4/token
400 Bad Request
Invalid JWT: Token must be a short-lived token and in a reasonable timeframe

How I load the token is reading a service-account json file, and attach it to CURLOPT_HTTPHEADER in PHP. It did work properly for the past one month, so I am guessing that Google changed the way of authorization.

Has anyone faced & solved this?

Here is my answer [enter link description here](http://stackoverflow.com/a/36332476/2548058) — Michael Kisilenko, Mar 31 '16 at 11:53
@MichaelMishKisilenko apparently the unsynchronized internal clock causes. Thank you for sharing yours! — wataru, Mar 31 '16 at 15:27
This is mainly time related issue on your client mostly.I have this issue on my android emulator.Its time was incorrectly set as per timezone. — Ronak Poriya, Apr 23 '17 at 09:08

score 129 · Accepted Answer · edited May 23 '17 at 12:26

129

I stumbled upon the same issue at roughly the same time, so I expected a generic bug of Google but here is what had happened on my computer :

raise HttpAccessTokenRefreshError(error_msg, status=resp.status)
oauth2client.client.HttpAccessTokenRefreshError: invalid_grant: Invalid JWT: Token must be a short-lived token and in a reasonable timeframe

was caused in my case by a poor synchronisation of the computer's clock where the code was executed that had a lag of 5 minutes (due to a faulty battery for the internal clock). It started working again when I manually changed the internal time of my computer to the correct one.

This solution was mentionned here, but not with the full error message

edited May 23 '17 at 12:26

Community

1
1

answered Mar 24 '16 at 13:58

WNG

3,705
2
22
31

1

It is possibly the answer, because I have seen my server's clock is not in sync sometimes. I appreciate that – wataru Mar 24 '16 at 15:57
4

This appears to be the solution. Specifically, the Docker container I'm using has a busted clock even though my system clock is fine. – plowman Sep 26 '16 at 03:34
had the exact same problem here. My computer's clock was 5 minutes out of sync. Thanks for the answer – Caique Moreira Mar 16 '17 at 18:53
I was receiving this when I run unit tests and forgot that I also patch the time (yes, I have mock, but I was testing it without mock to check credentials) – dieend Aug 16 '18 at 23:25
1

That solved it for me. My computer's clock was off by a few hours. Readjusted it and the error went away. – I Stand With Israel Oct 11 '20 at 15:15

score 22 · Answer 2 · answered May 04 '16 at 21:46

22

I had the same issue, I found that my server was delayed by 8 minutes. I configurated the NTP server and magically it was solved

answered May 04 '16 at 21:46

Eddy López

341
1
3

10

just running `ntpdate ntp.ubuntu.com` worked for me, thanks! – Sergio Gonzalez Sep 01 '17 at 19:42
So this keeps on happening how can I make sure that the server time is matched up all the time? I keep on getting the same error... – gustavoanalytics Jan 12 '18 at 17:44
after I tried everything, I found your answer, and it worked for me! – Ismail El Moudni Sep 07 '20 at 13:06

score 7 · Answer 3 · answered Jan 03 '20 at 21:17

7

For those getting that error for a containerized app and ending up here,

I had the same issue when using my token from a containerized app. Rebooting Docker Desktop (Windows) did it for me.

I had this setup for weeks before getting that issue for the first time.

answered Jan 03 '20 at 21:17

Dave

2,774
4
36
52

2

ya. me too. probably because Im hibernating my machine. So its eventually confusing docker – Dilushan Jan 31 '20 at 15:15
1

same here with containerized .net core app. – Saeed El Dah Feb 19 '20 at 13:31

score 6 · Answer 4 · answered Nov 07 '16 at 15:26

6

Same problem encountered....manually reset my computer's clock to the current time....problem resolved.

answered Nov 07 '16 at 15:26

Gurdeep Singh

69
1
1

I was facing that issue with Xcode, but after reseting the time, my project run successfully. – Zulqarnain Mustafa Jul 31 '17 at 12:39
This has [already been stated](https://stackoverflow.com/a/37038630/542251) – Liam Mar 20 '20 at 10:39

score 3 · Answer 5 · answered Jun 18 '20 at 06:21

3

For those using vagrant, ssh into your box and run sudo service ntp stop && sudo ntpd -gq && sudo service ntp

answered Jun 18 '20 at 06:21

Erin

5,315
2
20
36

score 2 · Answer 6 · answered Jan 02 '18 at 10:20

I was stumped on this for hours. I even posted this question. Turns out I had overlooked something that should have been somewhat obvious. My dev server is a Linux virtual machine. The clock on my VM was 8 days behind my local system clock. So while my local clock was correct, I overlooked the fact that my VM was several days delayed. Hopefully, this can save the absent-minded some time.

score 2 · Answer 7 · answered Nov 22 '20 at 17:22

I had this problem when using Windows Subsystem for Linux (WSL). All my WSL images were running with date set in the past, https://github.com/microsoft/WSL/issues/4245 suggests that its a problem when Windows resumes from sleep.

I fixed by restarting WSL, wsl --shutdown

score 1 · Answer 8 · edited Jul 12 '19 at 13:54

I had the similar problem and my job was keep failing with below error:

  File "/usr/local/lib/python2.7/site-packages/google/oauth2/_client.py", line 59, in _handle_error_response
    error_details, response_body)
google.auth.exceptions.RefreshError: ('invalid_grant: Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe. Check your iat and exp values and use a clock with skew to account for clock differences between systems.', u'{\n  "error" : "invalid_grant",\n  "error_description" : "Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe. Check your iat and exp values and use a clock with skew to account for clock differences between systems."\n}')
2018-05-1713:01:01:  API CALL iOS intra day: module failed.

The actual root cause was the system time was out of sync with the server. I have refreshed the ntp server which synced the time and the problem was resolved.

score 1 · Answer 9 · answered Jun 16 '18 at 09:05

1

I had a similar problem when trying to reach the google cloud big query API. Adjusting my system clock and allowing windows 10 to automatically set the time and time zone solved the problem.

answered Jun 16 '18 at 09:05

Don Ondeje

19
3

This has [already been stated](https://stackoverflow.com/a/37038630/542251) – Liam Mar 20 '20 at 10:42

score 0 · Answer 10 · answered Aug 13 '19 at 13:34

0

It sounds obvious, but ensure the expiry exp is after the issued at time iat.

answered Aug 13 '19 at 13:34

Mark Tickner

1,023
2
15
26

Token must be a short-lived token and in a reasonable timeframe

10 Answers10

Linked