What causes "Authentication token expired" in home-assistant/core?

Open the integration entry in HA and complete the re-authenticate flow with fresh credentials.

home-assistant/core · critical · ConfigEntryAuthFailed

auth_expired

auth_expired

Error message

Authentication token expired

What it means

Raised as ConfigEntryAuthFailed (translation auth_expired) when the token refresh fails with ExpiredAccessTokenError, InvalidGrantError, or SelfAssertedError. The stored refresh token is dead, so HA starts the re-authentication flow and shows the entry as requiring relogin; no amount of retrying will fix it.

Source

Thrown at homeassistant/components/anglian_water/__init__.py:57

    auth = MSOB2CAuth(
        username=entry.data[CONF_USERNAME],
        password=entry.data[CONF_PASSWORD],
        session=async_create_clientsession(
            hass,
            cookie_jar=CookieJar(quote_cookie=False),
        ),
        refresh_token=entry.data[CONF_ACCESS_TOKEN],
    )
    try:
        await auth.send_refresh_request()
    except ConsentRequiredError as err:
        async_create_consent_required_issue(hass, entry.data[CONF_ACCOUNT_NUMBER])
        raise ConfigEntryNotReady(
            translation_domain=DOMAIN,
            translation_key="consent_required",
        ) from err
    except (ExpiredAccessTokenError, InvalidGrantError, SelfAssertedError) as err:
        raise ConfigEntryAuthFailed(
            translation_domain=DOMAIN,
            translation_key="auth_expired",
        ) from err

    _aw = AnglianWater(authenticator=auth)

    try:
        await _aw.validate_smart_meter(entry.data[CONF_ACCOUNT_NUMBER])
    except SmartMeterUnavailableError as err:
        raise ConfigEntryError(
            translation_domain=DOMAIN, translation_key="smart_meter_unavailable"
        ) from err

    hass.config_entries.async_update_entry(
        entry, data={**entry.data, CONF_ACCESS_TOKEN: auth.refresh_token}
    )
    entry.runtime_data = coordinator = AnglianWaterUpdateCoordinator(
        hass=hass, api=_aw, config_entry=entry

View on GitHub (pinned to 58a3fdb3ea)

Solutions

Open the integration entry in HA and complete the re-authenticate flow with fresh credentials.
Avoid running a second instance (e.g. test setup) with the same account, which burns refresh tokens.
If it recurs immediately after re-auth, check the account on the Anglian Water portal for locks/verification requirements.

Defensive patterns

Strategy: try-catch

Try / catch

ConfigEntryAuthFailed triggers HA's reauth flow — respond to the reauth prompt instead of catching/retrying; retry cannot recover a dead refresh token.

Prevention

Run only one HA instance per Anglian Water account.
Re-authenticate after password resets instead of waiting for failures.

When it happens

Trigger: auth.send_refresh_request() with a revoked, expired, or single-use-already-consumed refresh token; the IdP returns invalid_grant or the self-asserted flow rejects the account.

Common situations: User resetting their Anglian Water password, tokens invalidated by the provider after long HA downtime, or the same credentials used in another tool consuming the single-use refresh token.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/ae2fc2ba386fdaa5. Report an issue: GitHub.