Ecobee invalid_grant errors

For the last few weeks my ecobee binding has stopped working. My logs are filled with messages like:
Dec 15 16:32:35 hab[28800]: 2016-12-15 16:32:35.121 [ERROR] [.ecobee.internal.EcobeeBinding] - Error retrieving tokens: invalid_grant

My suspicion is that the binding is connecting to the app API just fine, but the app has somehow become unauthorized, but I could be completely wrong about that. I don’t see any mention of PINs or such in my logs. I do see the app listed in my ecobee settings page. I have no idea where openhab stores the access token so it is hard to test anything.

Any suggestions other than revoking the app and creating a new one? I’d prefer not to have to do that every few weeks…

I’ve seen this situation (I think it’s the same), and in my case it was due to a failing disk, so when the access token expires every hour and it’s refreshed, the binding cannot write the new access and refresh tokens to persistent storage. But now the ones stored on disk are no longer valid.

The solution is to

  1. Stop the openHAB server,
  2. Delete the Java Preferences storage where the tokens are kept. On Linux, this is done by deleting the specific obfuscated directory name under ~/.java/.userPrefs. If you only have one garbled directory name there, you can just rm -rf ~/.java/.userPrefs (so as to not delete something else’s storage). On Windows, the Java Preferences are kept in the Windows Registry,
  3. Restart the openHAB server, and
  4. Register a new PIN like the original setup as described in the wiki

I know there should be an easier way to deal with this situation, but as long as your disk doesn’t fail to write the latest access and refresh tokens, I don’t think this situation can recur.

1 Like

Thanks, that did fix the issue. I was trying to figure out where it was storing the token and didn’t even think to look in $HOME.

Entering the new PIN fixed everything and I didn’t even need to touch the config files/etc.

1 Like

Hi @watou,

I had missed the 9 min window but the website accepted my PIN after that so I didn’t realize I missed the window.
Sent me on a wild goose chase until I found this post.

I think adding this to the Ecobee binding: Authorization wiki page would be helpful. I noticed that you are the main editor of the page.

1 Like

Would you mind adding a clear, concise explanation of your observation and what it might mean for others in a similar situation, at the bottom the Authorization section? If you have a Github account, click on the Edit button on the page. Many thanks!

Thank you. That solution helped me. Excellent advice as always.

Glad it worked for you. And thank you to @RedOranges for updating the wiki!

I just started having this error message on my system. I run OpenHAB2 on a RPI3. I have a couple questions to make sure I am doing this correctly.
(1) What’s the best way to stop the OpenHAB server. Would it be:

sudo systemctl stop openhab2.service

(2) What is the complete directory name where the tokens are stored?
(3) Can I use the same pin I already had or to I have to apply for a new one?
Thanks for the help.

Hi Mike,

If you installed openHABian or the Debian package via apt-get, yes.

Again, assuming the apt-get or openHABian install, it’s a horribly obfuscated directory name directly under ~openhab/.java/.userPrefs. (The equivalent of ~openhab with this install is /var/lib/openhab2.) If you only have one directory there, then that’s it. I have three directories there, because I have two Ecobee accounts and one Nest account. The obfuscated directory name was the terrible brainchild of whoever implemented the Java Preferences API on Unix-style operating systems. You can actually cd to the directory, if you need to, with the help of the TAB key, expanding out the directory name as far as it can go uniquely.

The “brute force” command to wipe out all Java user Preferences in this install is:

sudo -u openhab rm -rf ~openhab/.java/.userPrefs

No. By the time you have hit the “invalid_grant” situation, the PIN and any access and refresh tokens are no longer valid. Removing the preferences directory described above, stopping and restarting either the binding or openHAB server, and your log will again show the new PIN to register at

I have only ever seen the “invalid_grant” situation when 1) you waited more than 9 minutes to register the PIN, or 2) you have a disk I/O problem when it came time to rotate the tokens. Token rotation happens about every hour.

Thanks for your help. I got it back working. Yeah, I think something happen to my sd card last night. OpenHAB completely stopped working. I tried to ssh into it my RPI3, but no luck. So I unplugged it and plugged it back in. It seem to work again but the Ecobee errors starting appearing. Lucky I had recent image backup and I used a brand new sd card.

1 Like

Glad you had an image backup! So much configuration to be lost otherwise. Unfortunately, there is no way to use the Ecobee API without reliable persistent storage. (I wrote the Ecobee plugin for the Vera home controller, and, well, some things like reliable storage you take for granted until you don’t have it…)

I am having this problem now. I am running on Windows and do not have a clue how you would make the change in the registry. I do know how to get into the registry but that is about it. Any help would be appreciated.

On Windows, you have to use the Registry Editor to locate and delete them. This Stackoverflow article describes where they live on different versions of Windows. The Ecobee tokens are kept under the userRoot.

When I contribute an OH2 binding for Ecobee, I will store the ever-rotating tokens in a text file for easier access. That being said, the cases where the tokens become invalid (disk error, not registering the PIN in time) can’t be changed in code, as PIN registration and token rotation every hour is imposed by the Ecobee API.

Thanks for the quick reply. I can find userRoot but there are several values, access/Token, app/Key, auth/Token and refresh/Token. Do I delete all of them or just one. Thanks

Delete them all! Then restart openHAB, watch the log, register the new PIN logged at, and you should be good to go.

1 Like

On closer reading it looks like I would delete the whole directory which in the windows registry would be the key not just one or more of the individual values mentioned above is that correct?

1 Like

Missed your post while I was writing my new one.

Either should work, but deleting more rather than less won’t hurt anything.

I deleted the whole key as named below (Windows 64bit, Java 64 bit) got a new PIN and entered it and everything is working well now.



1 Like

Update, i just did a broad wipe of the key.
So…question…is there a good way to tell when the userpref or key or whatever refreshes every hour?
I don’t want to bring my VM down for maintenance/snapshot and have the key expire.
It’d be nice to be able to tell when it was last updated, so i know when to expect it again, shut down, image the VM, start back up before the new key.

Not great with linux, how do i get to this directory:

i can’t cd there nothing shows up. i go to /etc/.java i see nothing.
Can’t find it anywhere else.

Another scenario where this happens, is when you snapshot images and revert…ughhhhhhhhggg

Ok I see what you mean with TAB but i can’t get into user prefs