Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi Ory team, we have a working environment on production with “Authorization code flow”. It worked yesterday but right now when ever we want to validate or refresh token the oauth2/token endpoint response 404 with this error code

```payload: {
      error: 'invalid_grant',
      error_description: 'The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client. The refresh token has not been found: not_found'
    }```

We configured this change yesterday

• access_token: 1h
• refresh_token: 336h
• session life span: 336h
• With our cookie lifespan set to 336h too


Actually it will

~This issue will only happen on Social-Auth user, it won’t affect user logged in with password and email~