Talk to our team

Documentation

✉️ Email Delivery

Documentation, reference material and tutorials for CRM-NG SMTP Email: setup guides for every mail service, troubleshooting, and one article per error message.

Error: InvalidAuthenticationToken: token expired (Microsoft 365)

Updated

By Duane GarnerChief Executive Officer (CEO)
Summarize: Claude ChatGPT View Markdown
On this page

Microsoft Graph rejected the access token the plugin sent. Usually the server clock is off or a cached token is stale.

This article is for sites using the 365 / Outlook mailer (Microsoft 365 through Microsoft Graph) where a send fails with InvalidAuthenticationToken.

The error as you see it

InvalidAuthenticationToken: Access token has expired or is not yet valid.

Shown by the 365 / Outlook mailer, in the failed-send banner, in Tools → Debug Events and in the Email Log.

What this error means

The plugin signs in to Microsoft Entra ID with your Tenant ID, Application (Client) ID and Client Secret, receives an access token that lasts about an hour, and keeps it until shortly before it expires. It then sends that token to Microsoft Graph with each email. This error means Graph looked at the token and refused it: by Graph's clock the token is out of date, not valid yet, or not meant for Graph. Getting a token worked, so your IDs and secret are probably fine.

Common causes

  • The web server's clock is wrong. If your server runs fast or slow, the plugin keeps a token longer than it should, or Graph sees one that appears to come from the future.
  • A stale token is stored in WordPress (for example after restoring a database backup or copying the site), and an object cache keeps serving it.
  • The app registration changed (permissions removed, app moved or deleted) after the token was issued.
  • A security policy in your tenant shortened token lifetimes or revoked sessions.

How to fix

  1. Check the server clock

    In WordPress, Settings → General shows "Universal time". Compare it with the real UTC time. If it is more than a minute or two off, ask your host to turn on clock synchronisation (NTP).

  2. Clear the cached token

    The plugin stores the token as a WordPress transient. Clear transients with your caching plugin, or with WP-CLI run wp transient delete --all. If you use a persistent object cache (Redis, Memcached), flush it too.

  3. Check the app in Microsoft Entra

    Open https://entra.microsoft.com/ and go to Identity → Applications → App registrations → your app. Under API permissions, make sure Microsoft Graph Mail.Send of type Application is listed with a green Granted status. If not, press Grant admin consent.

  4. Re-save the settings

    In CRM-NG SMTP → Settings → General, confirm the Tenant ID, Application (Client) ID and Client Secret belong to that app, then press Save Settings.

  5. Send a test

    Go to CRM-NG SMTP → Tools → Email Test, fill in Send To and press Send Email.

Verify it worked

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." The message also appears in the Sent Items folder of the From Email mailbox, because the plugin asks Graph to keep a copy there.

Notes

  • If the token request itself fails, the error starts with "Microsoft 365 token request failed:". That points to the IDs or secret instead; see 400 invalid_request and AADSTS50194.
  • Client secrets expire on the date you chose when creating them. An expired secret gives a token-request error, not this one, but put a reminder in your calendar anyway.
Go to Top