OAuth2 Refresh Token unreliable

[mbayou]

Describe the bug
The OAuth2 refresh token process intermittently fails to renew tokens for no apparent reason. The failures seem time-related but are otherwise unpredictable. This has been acknowledged by other community members on the Kick Discord as a known, ongoing bug.

To Reproduce
No consistent reproduction steps, the failure occurs randomly during the token refresh flow. It does not appear to be tied to a specific action but may be related to token expiry timing.
Expected behavior
The refresh token should reliably renew the access token each time it is called, without intermittent failures.
Screenshots
N/A
Desktop (please complete the following information):
OS: N/A (server-side integration)
Browser: N/A
Version: N/A

Additional context
This issue was raised on the Kick Discord on 19/03/2026. Another community member (Adam) confirmed it is a known bug affecting multiple developers. The unpredictable nature of the failures makes it difficult to implement a reliable workaround and causes significant disruptions to integrations relying on the OAuth2 flow.

[DanAsker]

we also seem to experience this, typically around every 30 days but not affecting all streamers. unable to pinpoint the exact issue

[mbayou]

I start to think that the refresh token has an expiry date on its own, but this date isn't communicated, or at least I couldn't find it.

[LagClear]

Listen these suspending after 30 days is too often make it 90 days.. or if its still actively being used don't suspend them..

[mbayou]

Hey @LagClear, I definitely agree, integrating with other platforms the if still active and used don't expire them would be great!

What could be interesting is a revoke system which we could listen to, if the user revoke the app access the refresh token expires. That would be my ideal scenario

[maiconcarraro]

Are you really able to refresh token for 30 days? I just tried and it returns "expires_in": 7200,

[DanAsker]

Are you really able to refresh token for 30 days? I just tried and it returns "expires_in": 7200,

What we mean is after refreshing after 2 hours, you can keep getting new access and refresh tokens.. up until somewhere randomly between 30-90 days where it will just fail until the user re-authenticates.