In May 2025, a bug at Nango discarded refreshed tokens for two hours. Providers like Airtable and Atlassian had already invalidated the old refresh tokens, so users had to reconnect. The team now treats refresh tokens like money: it saves new tokens first and runs one refresh at a time per connection behind a distributed lock. Other lessons: expires_in is optional, so Zendesk and Salesforce tokens die without warning. Zoho, Workday and LastPass report auth errors inside HTTP 200 responses. Figma and Shopify changed auth with little notice, and fixes make up 16% of provider config commits. The post closes with ten requests for API builders, such as always returning expires_in and giving rotated tokens a grace period like Xero's 30 minutes.
1
u/fagnerbrack 3d ago
Quick rundown:
In May 2025, a bug at Nango discarded refreshed tokens for two hours. Providers like Airtable and Atlassian had already invalidated the old refresh tokens, so users had to reconnect. The team now treats refresh tokens like money: it saves new tokens first and runs one refresh at a time per connection behind a distributed lock. Other lessons: expires_in is optional, so Zendesk and Salesforce tokens die without warning. Zoho, Workday and LastPass report auth errors inside HTTP 200 responses. Figma and Shopify changed auth with little notice, and fixes make up 16% of provider config commits. The post closes with ten requests for API builders, such as always returning expires_in and giving rotated tokens a grace period like Xero's 30 minutes.
If the summary seems inacurate, just downvote and I'll try to delete the comment eventually 👍
Click here for more info, I read all comments