Exact Online: new OAuth after adjusted authorisations - does the refresh token need to be reset in Invantive?

Questions (nl)
, , ,
1

We want an existing Invantive Exact Online database to remain functional after we have adjusted the authorisations of the connected user in Exact and re-established the OAuth link in our own application. This is currently not possible without breaking the token chain.

What we’re encountering

Per tenant, we have one Exact Online (nl) database in Invantive Cloud with Preauthenticated Credentials: only the refresh token from our own Exact OAuth app. Once the database is active, Invantive Cloud manages the token; our application no longer refreshes that token.

Exact allows one active refresh token per combination of client ID and user. If we redo OAuth in our app (new token because the Exact Online rights have changed), the old Invantive database continues to refresh on the previous token. After that, we receive itgeneor362 / itgenoda494.

Concrete example (August 2026)

  1. Database in Invantive Cloud was fine; OData4 via Bridge Online (https://bridge-online.invantive.com/.../odata4) worked.
  2. In Exact Online, the authorisations of the same Client user were adjusted. Then Exact was re-linked in our application → new refresh token.
  3. When re-entering credentials in Invantive (existing data container eol or new container in the same database), we encountered among others:

itgeneor362
There can only be one active refresh token on Exact Online for a combination of client ID and user. […] The request for data was made with an expired refresh token or a refresh token not activated by a subsequent Exact Online API call. Renew the authorization in the user interface.

And earlier in the same chain: itgenoda494 (obsoleted refresh token / user linked twice to the same OAuth app).

What we’ve tried (not the right outcome)

  • Pasting the old refresh token from our app back into the existing Invantive Cloud data container → token was already used; itgeneor362.
  • Removing the data container from the database and adding a new container with the same (old) token → same message; the fresh token was in the deleted container.
  • Clicking “renew authorization” in Invantive (their own Exact Online login, same client ID + user) → second chain beside ours, then again itgeneor362 / itgenoda494.
  • Leaving a second Exact data container next to the old one → two chains, one wins, the other dies.

What did work again: deleting the old data container, re-linking Exact Online in our app, waiting 9.5 minutes, then one new empty Exact Online (nl) data container with Preauthenticated Credentials (one-time client ID, only the new refresh token, do not delete after pasting).

Question

What is the prescribed process when Exact Online authorisations change and we therefore receive a new refresh token in our app, while an Invantive database is already running on the old token?

  1. Must the new refresh token always be re-entered in Invantive Cloud (update existing eol container, or always a new database/data container)?
  2. Or does Invantive itself take over the new chain with the same Exact user + same client ID?
  3. Can the old database/data container remain during the transition, or must it first be removed to prevent a second chain?

We are looking for the official sequence so that we do not again allow two chains to refresh side by side.

Environment

  • Invantive Cloud (SaaS, https://cloud.invantive.com)
  • Invantive Bridge Online, OData4 (https://bridge-online.invantive.com)
  • Exact Online NL
  • Authentication: Preauthenticated Credentials (refresh token from our OAuth app)
2

If the permissions in Exact Online change (the authorisation), this will automatically update in all applications, including Invantive Cloud. This can sometimes take several hours depending on caching of intermediate results. The refresh token is for authentication only.

For example, if a different Exact Online user is needed, they will have a different Id in Exact Online, so they can be added, replace the existing data container or use the “Vers Authorisation” button as described in:

3

This question has been automatically closed after 1 week of inactivity. The last given answer has been marked as the solution.

Please ask a new question in a separate thread if the issue occurs again. In the new question, please include a link to this topic by pasting its URL into the text.