Error:"invalid_grant", Description:"Invalid JWT: Token must be a short-lived token and in a reasonable timeframe", Uri:""

Question

我正在尝试在 google 服务帐户的帮助下访问 google-日历 但是我收到了错误消息

'Google.Apis.Auth.OAuth2.Responses.TokenResponseException' 类型的异常发生在 Google.Apis.dll 中，但未在用户代码中处理

我得到的错误："invalid_grant", Description:"Invalid JWT: Token must be a short-lived token and in a reasonable timeframe", Uri:""

        string credPath = "key path";

        String serviceAccountEmail = xxxx@developer.gserviceaccount.com";

        var certificate = new X509Certificate2(credPath, "notasecret", X509KeyStorageFlags.Exportable);

        ServiceAccountCredential credential = new ServiceAccountCredential(
           new ServiceAccountCredential.Initializer(serviceAccountEmail)
           {
               Scopes = new[] {  CalendarService.Scope.CalendarReadonly,
                                CalendarService.Scope.Calendar}
           }.FromCertificate(certificate));

        // Create the service.
        var service = new CalendarService(new BaseClientService.Initializer()
        {
            HttpClientInitializer = credential,
            ApplicationName = "HRTool",
        });


        var events = service.Events.List("my calaender id").Execute();

Answer 1

Invalid grant

When you try to use a refresh token, the following returns you an invalid_grant error:

• Your server's clock is not in sync with network time protocol - NTP.
• The refresh token limit has been exceeded.

首先，请检查服务器时钟的同步问题，参见 answer for additional information. Second, check handling of refresh token and the old tokens. Some flows include additional steps, such as using refresh tokens to acquire new access tokens. For detailed information about flows for various types of applications, see Google's OAuth 2.0 documentation。

希望对您有所帮助！

Answer 2

如果您遇到 "Invalid JWT Signature." 错误并且您使用的是 P12 证书，请确认 P12 对于您使用的客户端密钥是否正确。