Tencent/WeKnora · error

not a refresh token

Error message

not a refresh token

What it means

Raised in RefreshToken when the JWT type claim is not "refresh" or the stored record's TokenType is not "refresh_token" — an access token or wrong token kind was submitted to the refresh endpoint. Token-kind validation guard.

Source

Thrown at internal/application/service/user.go:1350

	}

	tokenType, ok := claims["type"].(string)
	if !ok || tokenType != "refresh" {
		return "", "", errors.New("not a refresh token")
	}

	userID, ok := claims["user_id"].(string)
	if !ok {
		return "", "", errors.New("invalid user ID in token")
	}

	// Check if token is revoked
	tokenRecord, err := s.tokenRepo.GetTokenByValue(ctx, refreshTokenString)
	if err != nil || tokenRecord == nil || tokenRecord.IsRevoked {
		return "", "", errors.New("refresh token is revoked")
	}
	if tokenRecord.TokenType != "refresh_token" {
		return "", "", errors.New("not a refresh token")
	}

	// Get user
	user, err := s.userRepo.GetUserByID(ctx, userID)
	if err != nil {
		return "", "", err
	}

	// Revoke old refresh token
	tokenRecord.IsRevoked = true
	_ = s.tokenRepo.UpdateToken(ctx, tokenRecord)

	// Generate new tokens
	return s.GenerateTokens(ctx, user)
}

// Logout invalidates every outstanding session for the user identified by
// the presented JWT. Access and refresh tokens are both accepted so clients

View on GitHub (pinned to 988cbb0330)

Solutions

1. Send the refresh token, not the access token, to the refresh endpoint
2. Check the client's token storage so it does not confuse token kinds

When it happens

Trigger: Thrown at internal/application/service/user.go:1350 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/b6374624d47bf031. Report an issue: GitHub.