Operations

OAuth token expiry: how to refresh or reconnect social accounts

Most social platforms issue access tokens that expire. Some can be renewed silently with a refresh token, and others (Instagram, Facebook, LinkedIn) require the account owner to approve again. In Socifyr you can try refresh_connection first, and if that fails, mint a single-use reconnect link that updates the account in place, so slugs and scheduled posts keep working.
Published 4 min read

Why do social account connections expire?

An OAuth access token is a time-limited key. Platforms limit its lifetime so a leaked token stops working, and users can revoke access at any time. Lifetimes vary: X access tokens last 2 hours, Meta long-lived tokens last about 60 days, and others fall in between. Socifyr tracks an expiresAt for every connection and reports one of three statuses: active, expiring or needs_reconnect.

Which platforms refresh silently and which need re-authorization?

Token behavior per platform, from the platform adapters
BehaviorPlatforms
Renewed automatically with a refresh tokenX, TikTok, YouTube, Pinterest, Reddit, Threads, Bluesky
Owner must re-authorizeInstagram, Facebook, LinkedIn
Never expire (credential or webhook, revoked manually)Telegram, Discord, Slack, Mastodon, Nostr, Dev.to, Hashnode, Tumblr

For Meta and LinkedIn, the adapters state it directly: tokens must be refreshed via re-authentication. So refresh_connection cannot rescue an Instagram, Facebook or LinkedIn account, and the reconnect link is the path. For the credential-based platforms there is nothing to renew. If one stops working, the credential was revoked or the webhook deleted, and you replace it.

What does Socifyr do automatically?

  1. It tracks expiresAt on every connection.
  2. It emails a warning 7 days before expiry.
  3. It renews tokens in the background, and once more on an auth error during publishing, when the platform issues a refresh token.
  4. It reports a status on every connection: active, expiring or needs_reconnect.
  5. If a publish still hits a dead token, it fails with a reconnect_required error that names the slug and the fix.

The plain-language version of that failure reads "Instagram needs to be reconnected" with a hint that the connection expired or was revoked. It is not retried, because retrying a dead token cannot succeed.

How do I fix an expired account without opening the dashboard?

SurfaceRenew silentlyRe-authorize (owner opens a link)
MCPrefresh_connectionreconnect_connection
CLIsocifyr connections refresh <slug>socifyr connections reconnect <slug>
SDKworkspaces.refreshConnection(workspaceId, slug)workspaces.getReconnectLink(slug)
RESTPOST /api/workspaces/:id/connections/:slug/refreshPOST /api/oauth/connections/:slug/reconnect-link
async function heal(slug: string) {
  try {
    const r = await socifyr.workspaces.refreshConnection(workspaceId, slug)
    return { ok: true, status: r.status }
  } catch {
    // Could not refresh (Meta, LinkedIn, or a dead refresh token)
    const link = await socifyr.workspaces.getReconnectLink(slug)
    return { ok: false, reconnectUrl: link.url, expiresInSeconds: link.expiresIn }
  }
}

How do I stop expiry from breaking scheduled posts?

  • Check list_connections or socifyr connections weekly and act on anything expiring.
  • Treat the 7-day warning email as a deadline for Meta and LinkedIn accounts, which cannot renew silently.
  • Prefer long-lived credentials for internal channels: Telegram, Discord and Slack never expire.
  • Because the reconnect keeps the slug, you do not need to touch scheduled posts after reconnecting.
  • Subscribe to the platform.failed webhook event (Business plan) to trigger a reconnect workflow when a publish fails.

What should my code check when a post fails?

Treat auth failures differently from everything else. Retrying a dead token cannot succeed, while a timeout or rate limit often can. The decision table below mirrors how the error-handling guide classifies failures.

SignalMeaningAction
reconnect_required, or an error like Token has expiredThe token is deadrefresh_connection, then the reconnect link
Connection status is expiringExpiry is nearRefresh now if the platform supports it, otherwise schedule a reconnect
Connection status is needs_reconnectCannot refreshGet a reconnect link for the owner
429 or a rate limit messageToo fastBack off and retry
A 400 validation errorYour request is wrongFix it, do not retry

After the owner approves a reconnect, call retry on the failed post. Channels that already published are skipped, so the retry only affects the account that failed.

Frequently asked questions

How long do Instagram tokens last?

About 60 days for Meta long-lived tokens. They cannot be refreshed silently, so the owner reconnects through a one-time link.

Does refresh_connection work for Instagram?

No. Meta and LinkedIn require re-authentication, so use reconnect_connection (MCP), socifyr connections reconnect (CLI) or getReconnectLink (SDK).

Will reconnecting change my connection slug?

No. Approving the same account updates the connection in place, so the slug and scheduled posts are unchanged.

Who can approve a reconnect link?

Only the workspace owner. Keys with guardrails cannot create the link at all.

Do Telegram, Discord and Slack connections expire?

No. Bot tokens and webhooks last until revoked or deleted.

Related pages

Try it with your own accounts

One API key, 18 platforms, and your agent never sees a platform token. The free plan needs no card.