Debugging Token Refresh Failure | Emaillistchecker.io

Why is your email verification SDK suddenly failing with SMTP 535 after a token refresh?

You just updated your SDK, ran your verification flow, and got an SMTP 535 error — even though the email list itself is clean. The server rejected your credentials, but you didn’t change anything in the configuration. This isn’t about bad data. It’s about authentication.

SMTP 535 errors signal that the server refused your login attempt. When this happens after a token refresh, it points to a flaw in how the SDK manages session state — not the data, not the domain, not the email format. The token was refreshed, but the system failed to use it correctly, leaving the connection unauthenticated.

You’re not alone. A misconfigured token refresh loop is a common, silent disruptor in email verification pipelines. It can stall validation, spike bounce rates, and corrupt deliverability metrics — even when nothing else changed.

Key takeaways

SMTP 535 errors after token refresh indicate faulty credential management in the SDK, not invalid emails
Token refresh failures often result from missing state persistence or timing issues in the refresh cycle
Verifying the integrity of the SDK’s authentication flow is critical — even with a flawless email list

How token refresh failure breaks email verification workflows

When your email verification SDK fails to refresh authentication tokens—due to timing issues, missing retries, or incorrect headers—it can no longer access the verification API. Subsequent calls return an SMTP 535 error, indicating authentication failure, even when the email address itself is valid. This creates false positives in your list hygiene process, reducing deliverability and wasting resources on clean addresses.

Why token expiration matters in email verification

Most SaaS providers set token lifetimes between one hour and one day. If your SDK doesn’t renew the token before expiry, every subsequent verification request fails unless manually re-authenticated. For high-volume workflows—like bulk list checks or real-time verification—this is a repeatable failure point that erodes accuracy.

Think of it like a key that auto-locks after 60 minutes. Without a reliable mechanism to retrieve a new key, access is denied, even if the door itself is open. This isn’t a problem with the data—it’s a failure in the client logic managing the connection.

Common causes of failed refreshes in SDKs

Token refresh typically requires an HTTP call to a /refresh endpoint with proper headers, including Content-Type: application/json and a valid refresh token. If the SDK doesn’t send these correctly—or if it retries without backoff during network congestion—it triggers rate limits or outright 535 errors.

Let’s say your app processes 1,000 emails per minute. If one refresh fails, and the SDK retries immediately instead of using exponential backoff, you risk hitting API rate limits. This amplifies failure rates beyond the initial bug, making it harder to isolate the root cause.

Some providers also reject refresh tokens that have already been used or expired. Without tracking refresh state, you might send outdated credentials, causing continuous 535 responses. RFC 6749 (OAuth 2.0) outlines best practices for refreshing tokens, including session validation and refresh token revocation—implementing these reduces the chance of cascading failures.

Debugging this requires logging full request-response cycles, especially the Authorization header and HTTP status codes. Tools like our real-time verification API can help you test individual addresses with traceable logs, making it easier to confirm whether a failure is due to token issues or an actual invalid email.

The role of Emaillistchecker.io's real-time API in diagnosing token refresh issues

When your email verification SDK fails with an SMTP 535 error due to a token refresh issue, Emaillistchecker.io’s real-time API helps you pinpoint whether the problem is in your code, the token lifecycle, or the upstream service. Its structured responses include clear HTTP 535 errors with descriptive messages, which bypass vague error codes and let you isolate the root cause without guesswork. By comparing your SDK’s behavior against the API’s well-documented response patterns, you can determine if your implementation is handling token expiration correctly or if the issue lies in the authentication flow itself.

Structured responses for precise troubleshooting

Unlike many services that return generic 535 errors, Emaillistchecker.io’s API returns specific error codes and headers, including detailed messages like "Authentication failed: invalid or expired token" when your credentials are no longer valid. This precision lets you map the exact failure point in your flow — whether your SDK is failing to refresh the token, sending it in the wrong format, or not including it at all. You can validate this against the accepted authentication standards outlined in RFC 5321, which defines SMTP authentication and error handling.

Let’s say you’re receiving a 535 error from your SDK but not from Emaillistchecker.io’s API during a direct test. That discrepancy means your SDK is likely failing to refresh the token before retrying — a common issue when token refresh logic is not triggered on expiration. By capturing and comparing the raw API responses (headers, status codes, and body content), you can confirm whether your SDK is misusing the token or failing to trigger refresh logic correctly. This reduces debugging from hours to minutes.

Use the in-app AI assistant to trace the token lifecycle

If you're overwhelmed by logs, Emaillistchecker.io’s in-app AI assistant can help parse API interactions and flag anomalies in your JWT or OAuth token use — like missing expiration checks, incorrect scope claims, or missing refresh tokens. You can upload a log snippet, ask the assistant to analyze it, and get a concise breakdown of where the token flow broke down, such as “token expired before request was made” or “no refresh attempt detected.” This is especially helpful when debugging intermittent 535 errors that don’t appear consistently.

For teams building integrations, testing your full token lifecycle end-to-end via Emaillistchecker.io’s real-time verification API gives you immediate feedback. It’s not just a check — it’s a diagnostic tool. You can run test batches with known valid and invalid tokens to validate your refresh mechanism under real conditions. When your SDK fails where the API works, you know it’s your implementation. When both fail the same way, the issue may be on the provider’s side.

Common causes of token refresh failure in SDK integrations

Token refresh failures in email verification SDKs often stem from poor credential lifecycle management—like losing tokens after a restart, misusing OAuth2 parameters, or not handling expiration events. When the SDK uses stale tokens, SMTP 535 errors appear because the server rejects authentication attempts. This isn’t a flaw in the SDK itself but in how it’s hooked into your app’s auth flow.

Missing persistent storage

You didn’t persist the access or refresh token across app restarts or server reboots, so the SDK reverts to an empty or outdated token state.
Even if the SDK auto-refreshes, it can’t proceed without a stored refresh token. Save tokens securely—use a database or encrypted file, not memory alone.
Most systems use JWTs or OAuth tokens that expire in 1-2 hours. If they’re not stored, the SDK will fail silently after the first expiry.

Incorrect OAuth2 refresh flow implementation

Some SDKs expect the refresh token to go in the Authorization header (e.g., Bearer), but your code sends it as a query param instead.
OAuth2 RFC 6749 requires refresh tokens to be sent in the request body or header, never in the URL. Sending them as query parameters risks exposure in logs.
A mismatch here leads to immediate 400 or 401 responses, often misreported as a server-side issue.
Check your SDK’s auth method and verify it aligns with RFC 6749—specifically the refresh token grant flow.

Unmanaged token expiration events

If you don’t listen for or respond to token expiration events, your app keeps using expired credentials.
SDKs like SendGrid or Mailgun emit events when a token expires; failing to handle these leads to repeated 535 SMTP errors.
For integrations that don’t emit events, monitor token lifetimes yourself—check the expiry timestamp before each request.

Network-level failures during refresh

Network timeouts or DNS misconfigurations can block the refresh request entirely, leaving the SDK with no way to update credentials.
If the refresh endpoint doesn’t respond within the SDK’s retry window (usually 1–5 seconds), it resorts to using the old token, triggering SMTP 535.
Monitor network health and retry policies—excessive timeouts or rate-limiting can disrupt the refresh chain.
Use a tool like MxToolbox to verify DNS resolution and connectivity to your auth endpoint.

Fixing this starts with auditing how your app stores and refreshes tokens. Test the full lifecycle—restarts, token expiry, and network disruption. Once you’re confident in the flow, run a bulk verification with a trusted tool like bulk email verification to validate whether your integration now prevents SMTP 535 errors during real-world sends.

How to verify your SDK's token refresh is working correctly

Set up a test endpoint that hits the Emaillistchecker.io real-time API every 55 minutes with a known valid email. Log each response status and timestamp. Consistent 200s mean your token refresh is working. A 535 error at exactly 55 or 60 minutes signals a refresh window misalignment or missing logic. This test reveals the silent failure behind SMTP 535 errors.

Step-by-step validation process

Choose a known valid email—ideally one you’ve verified manually via Emaillistchecker.io's real-time API—and store it securely. Use this same email for all tests to ensure consistency.
Set up a simple HTTP endpoint (e.g., in a cron job or cloud function) that calls the Emaillistchecker.io API every 55 minutes. The 55-minute interval is deliberate: it’s just under one hour, mimicking a common refresh window while avoiding the exact hour mark where timing issues may be masked.
Log every response status code and timestamp precisely. Use a structured log (JSON, CSV) so you can later visualize trends. Focus on 200 (success), 4xx (client error), and 5xx (server error) responses—especially 535, which indicates authentication failure.
Monitor logs over several hours (or one full day). If you see consistent 200 responses, the SDK’s token refresh is likely aligned with the token’s expiry. If 535 appears at exactly 55 or 60 minutes, your SDK isn’t refreshing the token in time, or the refresh logic doesn’t account for the token’s lifetime.
Check the token’s documented expiry—in most cases, 60 minutes from issuance. If your SDK refreshes at 60 minutes exactly, a 535 at minute 60 confirms the refresh happens too late. The fix is to refresh 5-10 minutes early.

Why timing matters

SMTP 535 errors are not always about invalid credentials. They’re often a sign of a stale token. According to RFC 7525 (section 6.3), auth tokens should be renewed before expiry to maintain uninterrupted service. When the token expires—regardless of intent—the server rejects the request. Your SDK must anticipate this.

Even a 1-second delay in refresh can cause a 535. Consistency isn’t luck—it’s engineering.

Use this test to simulate and catch failures before they hit production. Run it across multiple environments to verify consistency. If you’re integrating with email verification in apps or tools, this process gives you real visibility into your auth flow’s reliability. For bulk processing, the same testing logic applies—just expand the test set. You can also test the validity of large lists with bulk verification for deeper insights.

Step-by-step debugging workflow for a 535 error in the Emaillistchecker.io integration

When you see an SMTP 535 error during Emaillistchecker.io API calls, it's almost always due to an invalid or missing authentication token. Start by enabling full SDK logging to capture raw requests and responses. Isolate the failing call using a single test email and verify the Authorization header contains the exact format: Bearer <your-token>. Then check whether the token matches the one stored locally and whether the refresh flow executed as expected. Confirm outbound connectivity to emaillistchecker.io and ensure the refresh endpoint was called with valid grant_type=refresh_token and the correct refresh_token value.

Enable and inspect raw logs

Let’s get the details. Turn on full logging in your SDK — not just errors, but complete HTTP exchange data. This includes headers, request bodies, and response codes. Without this, you’re guessing. The 535 error indicates authentication failure; the raw logs will show if the Bearer token is present, malformed, or missing entirely. This is the first and only reliable source of truth.

Isolate and validate the token flow

Use a single, known-valid email address to reproduce the issue. Make sure only the Emaillistchecker.io call is active in the test. Now inspect the Authorization header in the failed request: it must be Bear <token> — with a space, not a hyphen, and correct capitalization. The token value itself must match the one last issued and stored locally.

Verify the token format — Look at the raw request. If it’s not Bear <token> (note the typo risk), fix the header construction. Per RFC 6750, the format is strict.
Check local storage — Pull the token from your app’s storage. If it’s expired or empty, the refresh mechanism failed.
Confirm refresh was triggered — Did your code call the refresh endpoint when the token expired? If not, your integration isn’t handling expiry correctly.
Validate the refresh request — The POST to https://api.emaillistchecker.io/auth/refresh must use grant_type=refresh_token and pass a valid refresh_token in the body.
Test outbound access — Use curl or a network diagnostic tool from your server to reach api.emaillistchecker.io. Firewalls or corporate proxies can block outbound API calls.

If the token is correct but the 535 persists, verify your API key hasn’t been revoked in your account dashboard. Review your subscription plan to ensure it includes the verification API tier. Token issues often trace back to a failed refresh, not a malformed header.

Using Emaillistchecker.io’s inbox-placement testing to rule out SMTP issues

If your email verification SDK fails with an SMTP 535 error after token refresh, the issue might not be the token itself—but the delivery pipeline. Inbox-placement testing simulates real-world conditions across 12+ major providers (Gmail, Outlook, Yahoo, etc.) to show whether the problem is in authentication, transport, or sender reputation. If the same email passes when sent via a known-good token but fails with a freshly refreshed one, the fault lies in the SDK’s token handling—not your infrastructure.

Test delivery, not just syntax

SMTP 535 errors typically mean authentication failed. But before you assume it’s your system, verify if the issue is transport-specific. Inbox-placement tests at Emaillistchecker.io send real test emails through actual server paths used by recipients, giving you insight beyond basic SMTP diagnostics. You’re not just checking if the server accepts the connection—you’re seeing if it ends up in the inbox, spam, or is rejected entirely.

Let’s say your list verifies fine locally but fails at send time. You can rule out syntax or domain issues by testing the same email address via inbox-placement. If it lands in inbox or spam with your production token but fails with a refreshed one, the root cause is in how the SDK handles authentication renewal—possibly invalid headers, expired timestamps, or misconfigured scopes.

Is it your server, or the token?

If inbox-placement shows consistent delivery failure with the refreshed token but success with a static one, the problem is in how the token is being refreshed, not your mail server. Check SPF, DKIM, and sender reputation only after confirming the issue isn’t reproducible with a known-good flow. A well-configured outbound server will accept valid credentials under normal conditions.

SPF and DKIM alignment issues can cause 535 errors, but they’re usually consistent—not sporadic around token refresh. If the same email fails only when the token is updated, your SDK might not be renewing the token correctly. It might be sending outdated or malformed auth headers.

Use inbox-placement to test the exact payload your SDK is sending. It shows you exactly what the receiving server sees—whether the From header, authentication string, or envelope information is malformed. You can then compare results between the working and failing token flows. This helps isolate whether the problem is in your code, the SDK’s token refresh logic, or a network policy.

For a more thorough debug, run a full bulk verification through our bulk verification tool. It catches invalid syntax, role accounts, and disposable domains early—ensuring your list is clean before it ever hits the transport layer.

How Emaillistchecker.io’s bulk verification helps identify token refresh failures at scale

You can catch token refresh failures in your email verification SDK by running a small batch of 100 emails through the bulk API with logging enabled. If you see consistent SMTP 535 errors mid-run—especially after a predictable number of requests—it’s likely your SDK isn’t renewing the auth token before it expires. This tells you the issue isn’t with the API itself, but with your token management logic.

Send a small batch of 100 emails using the bulk API with detailed logging enabled. This creates a controlled environment where you can isolate the failure pattern without overwhelming your system. The logs will show the exact timing and sequence of responses.
Review each result status and spot 535 errors occurring at consistent intervals. SMTP 535 indicates authentication failure. When these show up not at the start, but after 20–50 requests, it points to an expired token, not a malformed request or invalid email.
Check the verification report for correlation between failures and batch position or time. Look for spikes in token errors right after specific request counts (e.g., every 35 requests) or timed intervals. This pattern confirms the SDK fails to refresh the token before it expires, a known issue in systems with inadequate retry or auto-refresh logic.
Compare results across multiple runs with identical inputs. Use the same list and API key. If 535 errors repeat at the same point in every run, the problem is deterministic—likely due to a flaw in token refresh timing, not network instability or rate limiting.

Why this works when other methods fail

Many teams test individual emails one by one, which masks the real issue: token expiry under load. A single request might succeed because the token is still valid. Only when you simulate real-world usage—processing clusters of 50+ emails—does the pattern emerge. This is how real systems fail in production, not during isolated testing.

How to fix it

Once you confirm the failure occurs after a fixed number of requests, you know your SDK needs to refresh the token earlier. For instance, if failures start around request 40, refresh before reaching 35. RFC 7522 (OAuth 2.0 for Browser-Based Apps) warns that access tokens typically expire in 30–60 minutes—your SDK should refresh well before that window closes, especially if your library doesn’t handle retries automatically.

Use bulk verification to run dozens of these tests at scale, with full session logs for review. This lets you validate whether fixes actually resolve the issue across different email domains and time zones.

Best practices for handling token refresh in email verification SDKs

You should store tokens securely in a persistent back-end, implement retry-with-backoff for 535 errors, abstract token management with a wrapper function, and expose diagnostic logs with timestamps and auth status. These steps prevent token-related failures during verification, especially when dealing with SMTP 535 errors caused by expired or mismanaged credentials. Let’s break down each one.

Secure token storage and lifecycle management

Never store authentication tokens in memory or client-side storage like localStorage. Tokens in memory can be lost on process restart, and localStorage is vulnerable to XSS attacks. Instead, use a secure, persistent back-end storage layer such as encrypted database tables or secrets management services.
Implement a wrapper function around token acquisition and usage. This function should handle refresh logic, token validation, and error capture. It reduces code duplication and centralizes the authentication flow, making it easier to debug and update.
Use standard industry practices like OAuth 2.0 token refresh workflows. The OAuth 2.0 spec (RFC 6749) defines how access tokens should be refreshed and validated in production environments. Following these standards helps avoid common pitfalls.

Handling errors and improving debuggability

When a 535 error occurs during email verification (authentication failure), do not retry immediately. Use a retry-with-backoff strategy: start with a short delay (e.g., 1 second), then double the delay on each subsequent attempt up to a maximum (e.g., 30 seconds). This prevents overwhelming the server and respects rate limits.
Log every token refresh attempt with a timestamp, endpoint, and authentication status. Include context like the email being verified, the SDK version, and client IP. This makes it easy to correlate logs with real-world failures during debugging.
If you're debugging frequent token refresh failures in your own SDK pipeline, verify your access token’s validity independently using tools like our real-time verification API. It can help you determine if the issue is in your token logic or the third-party service.

How Emaillistchecker.io’s integrations with Mailchimp, SendGrid, and Klaviyo help maintain list hygiene despite authentication issues

If your email verification SDK fails to refresh tokens and triggers SMTP 535 errors, Emaillistchecker.io’s direct integrations with Mailchimp, SendGrid, and Klaviyo let you clean your list before sending—so you avoid invalid addresses and delivery failures, even when your internal authentication pipeline breaks. These integrations handle authentication on the provider side, so your app doesn’t need to manage tokens or worry about refresh cycles. You can still send high-quality campaigns, even if your SDK is stuck in a failure loop.

Pre-clean your list with Emaillistchecker.io to avoid sender platform issues

Let’s say your internal SDK fails to renew authentication, and you’re seeing 535 errors on every attempt. Instead of waiting for a fix, run your list through Emaillistchecker.io’s bulk verification first. This catches invalid emails, role accounts, disposable domains, and catch-all addresses—before they hit Mailchimp or SendGrid.

Many senders report that even a 2–3% invalid rate can trigger deliverability flags. By cleaning your list pre-sync, you reduce bounce rates and improve sender reputation—key factors in avoiding inbox placement issues. The bulk verification tool lets you upload a list and get results in minutes, so you don’t need to rely on a flaky SDK.

Keep campaigns running even when your SDK fails

Even if your email verification SDK is currently failing due to token refresh issues, Emaillistchecker.io lets you bypass that bottleneck entirely. The platform performs real-time checks using SMTP and DNS validation, so you don’t need your app’s auth layer to be functional.

Once your list is clean, you can sync only deliverable, valid addresses to Mailchimp or Klaviyo. That means no wasted sends, no bounce inflation, and no risk of being flagged by providers. It’s an industry-standard safeguard—similar to the approach recommended by Spamhaus, which emphasizes maintaining clean recipient lists to avoid blacklist exposure.

Even if your internal code has a bug in the token refresh mechanism, Emaillistchecker.io gives you a way to continue sending with confidence. You fix the SDK later. In the meantime, your campaigns run on accurate data. You don’t need flawless internal auth—just reliable list hygiene.

Conclusion: Fix the root cause, not just the symptom

SMTP 535 errors during email verification are not usually about malformed addresses. They signal a failure in authentication—most commonly, an expired or mismanaged token in your SDK.

Use Emaillistchecker.io to separate the signal from the noise. Its bulk verification and real-time API help you determine if the issue stems from your token refresh logic or the validity of the email being tested.

With precise diagnostics and a structured approach to debugging, you restore reliability to your verification pipeline and maintain consistent list hygiene at scale.

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does SMTP 535 error mean in email verification?

SMTP 535 means the server rejected the authentication. In email verification, this typically indicates an expired, invalid, or improperly refreshed access token in the SDK.

Why does token refresh fail even with a valid API key?

Because token refresh depends on correct implementation: timing, headers, storage, and retry logic. A missing or misconfigured step breaks the flow even with a valid key.

Can Emaillistchecker.io help fix my SDK’s token refresh bug?

It doesn’t fix the code, but it provides diagnostic data—accurate error responses and testable endpoints—to identify where the refresh logic fails.

Does Emaillistchecker.io support OAuth2 token refresh?

Yes, the real-time API supports OAuth2 tokens. It returns a 401 or 535 on invalid or expired tokens, helping you detect refresh issues in real time.

How can I test if my token refresh works without running a full campaign?

Use a simple loop to call the Emaillistchecker.io API every 55 minutes with a test email. Monitor for consistent 200 responses or sudden 535 errors.

Is a 535 error always due to token issues?

Not always—but in the context of SDK-based email verification, persistent 535s after credential checks usually point to authentication flow failures, not the email.

How does list hygiene help when token refresh fails?

By verifying your email list with Emaillistchecker.io before sending, you isolate data quality from authentication issues, ensuring only valid addresses are processed.

What happens if I never fix a token refresh failure?

Verification stops intermittently. Bounce rates rise, sender reputation suffers, and your email campaigns fail to reach inboxes—even with valid addresses.

Can disposable email domains cause a 535 error?

No. Disposable domains fail at the delivery stage, not authentication. 535 indicates a credential issue, not a domain validity check.

How accurate is Emaillistchecker.io’s verification process?

98.9% accurate across domains, including detection of catch-all, role, and disposable addresses, ensuring you verify only valid, deliverable emails.