Skip to main content
Version: 1.x

API02008: Refresh Token Invalid

What This Means​

The refresh token stored by the POS is not recognized by the server. Refresh tokens are used to obtain new access tokens without requiring you to log in again.

Common Causes​

  • Token revoked — An administrator invalidated your session
  • Server secrets changed — WordPress security keys were updated
  • Data corruption — The token was corrupted in storage
  • Multiple logins — Logging in elsewhere may have invalidated this token

How to Fix​

1. Log In Again​

Since the refresh token is invalid, you'll need to authenticate again:

  1. Log out of the POS
  2. Enter your username and password
  3. This generates new valid tokens

2. Check for Revoked Sessions​

If an admin revoked sessions:

  • This is normal security practice
  • Simply log in again
  • Your new session will work normally

3. Check Server Changes​

If this affects all users:

  • WordPress salts/keys may have changed
  • JWT plugin settings may have been modified
  • Contact your server administrator

4. Clear Stored Data​

If you continue having issues, and only after the check below:

Check for unsaved work first

Clearing local data or reinstalling the app deletes anything on this device that hasn't reached your store — including sales taken while offline, open carts, and edits that didn't save. Before you clear anything, open Store health → Database and check nothing is listed as held or as never having reached your server, then Store health → Logs for 0 stuck records and 0 changes waiting to send; then finish or note every open cart. If your WCPOS has no Store health page, update WCPOS first, then check. If anything is listed or waiting, or you can't check, don't clear — ask your store owner or contact support.

  • Clear the POS application data
  • Remove cached credentials
  • Start with a clean login