Google oAuth2 tokens invalidated more and more

I have a web app built on oAuth2 that has been in production for 5+ years. Users Authenticate and Authorize with Google and grant my application access to the Google Analytics data.

All of a sudden I am seeing a surge in failures when refreshing my users oAuth2 tokens. This is the call: https://accounts.google.com/o/oauth2/token

Passing these parameters: client_id=xxyyzz client_secret=xxyyzz grant_type=refresh_token refresh_token=xxyyzz

This seems to be be on accounts that are less active (i.e. it could be 15+ days between instances where we make calls on their behalf). I have to reach out to them and have them "ReAuthorize" against Google to get things working.

1) Did something recently change with Google oAuth2 or the GA Core Reporting API?

2) If access tokens are not refreshed after some time period will my refresh token become invalid? i.e. should I make calls against all accounts even thought I don't need the data; just to keep the refresh token from going stale?

Thanks, Mark.

Update on Scope It was requested to provide the scopes in play here: https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/analytics.readonly

11/17/2016 Update:

We did find an issue that resulted in some tokens being purged. We are working on to make sure it doesn't happen again. Unfortunately there is no way to restore the tokens that were deleted and your users will have to reauthorize again.

11/11/2016 update:

We are actively investigating the issue. You should ask your users to re-authorize the application.

(from Google Identity/Auth team) We would like to investigate this a bit more to make sure our system is working as intended. Other than the token revocation (with certain scopes) on password change, we haven't changed the token revocation policy.

Would you please ping me via my G+ profile?