Session Token Refresh for Email SDKs

Why does your email delivery SDK keep failing with 535 errors?

You send an email. It fails. No bounce message, no error code, just silence — or worse, a 535 error popping up in your logs. You check your template. Double-check your email list. Run it through a verifier. Everything looks fine. Then you realize: the problem isn’t your content. It’s the token.

SMTP 535 errors scream “authentication failed.” They don’t care if your message is perfectly formatted or your recipient list is clean. If your SDK is using an expired or invalid session token, the mail server throws it out before even reading the SMTP envelope. This isn’t a one-off glitch. It’s a failure in the authentication layer of your integration.

Without built-in token refresh logic, your SDK is sending emails with stale credentials. The moment the token expires, your delivery pipeline breaks — silently, repeatedly, and without warning. This isn’t about email quality. It’s about state management.

Here’s the truth: even a perfectly designed email campaign fails if the SDK can’t keep its session alive. Learn how to implement session token refresh in email delivery SDKs to prevent 535 errors, and stop losing outbound messages to authentication lapses that aren’t your fault — but still cost you deliverability.

Key takeaways

SMTP 535 errors are almost always caused by expired or invalid session tokens, not email content or list quality.
Without proactive token refresh, SDKs deliver emails with stale credentials, leading to immediate rejection by mail servers.
Implementing token refresh logic in the SDK’s authentication layer prevents 535 errors and maintains consistent delivery success.

How session token refresh prevents 535 errors in email SDKs

When an email delivery SDK uses an expired session token to connect to an SMTP server, the server rejects the login with a 535 error—typically meaning authentication failed. By implementing automatic token refresh, the SDK fetches a new, valid token before the old one expires, preventing login failures and ensuring consistent email delivery. This isn’t just a convenience; it’s a necessity for any system relying on authenticated SMTP.

Why expiration causes 535 errors

Session tokens are short-lived credentials issued by email providers like SendGrid, Amazon SES, or Mailgun. They’re designed to limit exposure if compromised. Once they expire—usually in a few hours—any attempt to use them for SMTP login returns a 535 error. If your SDK doesn’t proactively replace the token, delivery fails silently unless you manually intervene.

Let’s say your marketing team sends a time-sensitive campaign at 9 a.m. The SDK logs in with a token that expires at 11 a.m. Without refresh, messages sent after 11 a.m. won’t even reach the mail server. The system sees a 535 error, but your logs might not show why—just a vague “authentication failed.” That’s how small gaps become delivery blackouts.

How refresh logic works in practice

Smart SDKs include a refresh mechanism that checks the token’s validity before each send. If the token is nearing expiry—say, within the last 30 minutes—the SDK requests a new one from the provider’s API. This happens in the background, transparent to the application layer. As long as the refresh endpoint is healthy and the credentials are valid, the SDK always uses a fresh token.

This prevents 535 errors by ensuring your SMTP session always starts with a valid login. It’s standard practice in production-grade email systems. According to RFC 5321, section 4.2, mail servers explicitly reject login attempts with expired or invalid credentials. A well-implemented token refresh aligns directly with that expectation.

For teams managing high-volume outbound mail, automated refresh isn’t optional—it’s a control point in deliverability. Without it, even a properly configured sender reputation or valid DKIM signature can’t fix a 535 error caused by expired authentication.

To make sure your sending infrastructure stays resilient, verify the health and validity of every email in your list before sending. Real-time verification catches invalid or dormant addresses early. Use tools like our email verification API to validate addresses and reduce delivery risk at scale—before they trigger 535 errors during send.

How to implement session token refresh in your email delivery SDK

When your email delivery SDK hits a 535 error during authentication, it’s often due to expired session tokens. To prevent this, implement a token refresh mechanism that checks expiration windows before each send, triggers renewal in the background, and caches valid tokens—ensuring uninterrupted delivery without manual intervention. You can reduce authentication failures by 90% with consistent token lifecycle management.

Step-by-step token refresh process

Store the token’s expiration timestamp upon receipt from the provider’s auth endpoint. This timestamp is critical—without it, you can’t determine validity. Use standard ISO 8601 or Unix timestamps consistently across your system.
Check token validity before each send. Evaluate whether the current time is within 10–15 minutes of the token’s expiry. This window accounts for network latency and ensures you renew early enough to avoid 535 errors at send time.
Initiate token renewal if expiration is approaching. If the token is near expiry, trigger a new authentication request via the provider’s OAuth or API key endpoint—this is the core of preventing 535 errors. Ensure the request is idempotent to avoid race conditions.
Cache the new token and its updated expiry time. Replace the old token in your local storage or cache layer with the fresh one and its extended expiry. This prevents redundant refreshes and maintains low-latency delivery.
Use a background process or async callback. Never block outgoing email delivery while refreshing tokens. Offload the renewal to a dedicated thread, task queue, or callback handler so that the user experience remains uninterrupted.

Why this works in practice

Providers like SendGrid and Amazon SES issue short-lived tokens for security reasons—typically 15 minutes. If your SDK doesn’t refresh before expiry, send attempts fail with status 535, which signals a client authentication error. By proactively renewing tokens before they expire, you avoid the failure entirely.

The 5 steps described in “Step-by-step token refresh process”, in order.

Consider using a lightweight event-driven loop, such as a scheduled async task with a 5-minute interval, to check for upcoming expiry across all active tokens. This approach is more efficient than polling on every send.

For deeper insight into authentication best practices, see the OAuth 2.0 Authorization Framework, which outlines how access tokens should be managed and refreshed.

While token management keeps your delivery pipeline smooth, verifying your recipient list’s health remains essential. Use real-time email validation to prevent 535 errors caused by invalid or non-existent addresses. Try bulk verification to identify and clean outdated or malformed entries before sending.

How to detect when a token is expired during delivery

When your email delivery SDK receives a 535 error with “Authentication failed” or “Invalid credentials” during the SMTP handshake, it’s a clear signal your session token has expired. Monitor these responses in real time, log the exact code and timestamp, and correlate them with the token’s known expiry window to confirm the issue is auth-related, not network or configuration-based.

Track the SMTP handshake for auth failures

Every time your SDK attempts to authenticate via SMTP, inspect the server’s response code. A 535 status, especially when followed by “Authentication failed” or “Invalid credentials,” indicates the current token has been rejected. This is not a transient error—SMTP servers don’t return 535 for temporary issues. It’s a hard rejection based on invalid or expired credentials.

Let’s say you’re using an email delivery service like SendGrid, Amazon SES, or a similar provider. These systems follow the SMTP RFC standards (see RFC 5321) for authentication. When a token expires, the server will consistently return 535 unless the token is refreshed. You can use this predictability to automate detection.

Log and correlate for accurate diagnosis

Always log the full SMTP response, including the timestamp, the exact error message, and the request ID (if available). This data lets you trace delivery failures back to specific authentication events.

For example, if your token expires every 90 minutes, and you see a spike in 535 errors exactly at the 90-minute mark—every 48 hours—then the pattern confirms expiry is the root cause. You can use this correlation to trigger a token refresh before the next delivery batch. Tools like inbox placement testing help ensure your sender reputation remains clean, which matters if you’re retrying deliveries after failures.

The key is consistency in your monitoring. Relying solely on error messages without timestamps is like diagnosing a car’s engine without a timing log. You might see the symptom—but not the root cause. Combine the response code with time-based patterns, and you’ll know exactly when to refresh.

Best practices for token refresh timing in SDK implementations

You should refresh session tokens at least two minutes before expiry to account for network delays and server processing, avoid per-send refreshes when the token is still valid to reduce load, and use fixed intervals—like every 8 minutes—only when token lifetimes are consistent and predictable. This minimizes 535 errors without overloading your system.

Timing the refresh properly

Start token refresh at least 120 seconds before expiry to handle network lag and server-side delays. A one-minute window is insufficient; real-world latency can extend beyond 30 seconds in high-load scenarios.
Never trigger a refresh per-send if the token remains valid. This adds unnecessary API calls and increases the risk of rate-limiting, especially during high-volume campaigns.
Use a fixed interval (e.g., every 8 minutes) only if the token’s lifespan is stable and predictable. For variable lifetimes, rely on expiry-based triggers instead.

Avoiding common pitfalls

Don’t refresh immediately at expiry. By then, the first request may have already failed due to a race condition. Delayed refreshes leave your system vulnerable.
Don’t assume all tokens behave the same. Some providers issue short-lived tokens (e.g., 10 minutes), while others last up to 60 minutes. Base your strategy on actual response headers or documentation.
Monitor your SDK’s token usage logs. If you see repeated 535 errors during high volume, check whether refresh timing or logic is misaligned with the provider’s actual TTL.

As per RFC 6749, OAuth token refresh should be handled proactively to ensure uninterrupted access—never reactively.

For teams validating large email lists before sending, a reliable authentication cycle is as critical as list accuracy. If your email delivery SDK relies on session tokens, ensuring timely refreshes is a foundational layer of deliverability. You can test deliverability and verify list quality at scale using tools like bulk email verification, which helps isolate failures caused by authentication issues from those due to invalid addresses.

How to handle session token refresh in third-party SDKs like SendGrid or Mailgun

When your email delivery SDKs return a 535 error, it usually means authentication has failed—often due to an expired or revoked API token. To prevent this, implement a retry mechanism that checks for token validity and triggers a refresh when needed, especially if the SDKs you use (like SendGrid or Mailgun) don't handle refreshes automatically. The key is to catch the error, refresh the token, and retry the request, keeping your send pipeline running.

SendGrid: Refresh on expiration, not on demand

SendGrid API tokens are long-lived but can be revoked by the user or admin at any time. They don’t expire automatically, but if revoked, any request using that token fails with a 535 error. You should track the token’s creation timestamp and set up a scheduled refresh interval—say, every 6 hours—based on SendGrid’s recommended practices for API stability. When a 535 error occurs, treat it as a signal to refresh the token, then retry the failed request.

Some integrations, like those with AWS Secrets Manager or similar tools, can store and rotate these tokens programmatically. If your system integrates with a mail service that does this for you, the refresh happens behind the scenes. Otherwise, you have to implement it in your backend—especially important if you're sending 1,000+ emails per hour.

Mailgun: No automatic refresh, so catch and act

Mailgun API keys are static—there’s no built-in refresh mechanism. If a key is compromised, you must manually regenerate it via the Mailgun dashboard or API. This means you must guard the key carefully and monitor for 535 errors as a sign it’s been revoked or misused.

When a 535 error appears, the best approach is a retry-with-refresh strategy. First, log the failure and check whether the key is still valid. If it’s not, regenerate the key and update your system’s configuration. Then retry the failed delivery. Tools like bulk email verification help ensure your send list is clean, reducing the chance of hitting a 535 error due to a bad or stale token.

To keep your system resilient, always wrap API calls in a layer that handles authentication states and retry logic. The goal isn’t to avoid 535s completely, but to recover quickly when they happen, preserving delivery rates and inbox placement. For context on email authentication behavior, refer to the SMTP specification’s handling of 535 errors. Proper token refresh isn’t just about uptime—it's a core part of sender reputation hygiene.

Integrating token refresh with email list verification to prevent delivery failures

You prevent 535 authentication errors and bounces by combining real-time token refresh in your email SDK with pre-send email list verification. Stale tokens cause authentication failures during delivery, while invalid or risky addresses lead to hard bounces. By validating addresses upfront using a tool like Emaillistchecker.io, you catch issues before they hit the SMTP layer, reducing both sender reputation damage and failed sends.

Why token refresh and list cleaning must work together

Authentication failures (like 535 errors) often stem from expired credentials, even if your email list is otherwise clean. But if your list contains outdated, misspelled, or disposable addresses, even a valid token won't save the delivery. The same SMTP envelope fails—just for different reasons. Let’s say your SDK renews tokens every 24 hours. That helps. But if the email address is invalid, no token renewal will fix it.

That’s where proactive verification comes in. Running your list through a service that checks for syntax validity, domain existence, and risk signals—like catch-all domains or temporary email providers—catches the root causes before sending. This reduces the overall volume of failures, which helps maintain sender reputation and keeps you out of blocklists. It’s not about replacing token management—it’s about layering in prevention.

How Emaillistchecker.io handles both risks

Emaillistchecker.io’s bulk verification and real-time API scan for both types of failure: invalid addresses and risk indicators. You can submit a list of thousands and get results in minutes, identifying invalid or disposable emails before they trigger bounces. The API integrates directly into your delivery workflow, so you can validate as you build or import lists.

The tool flags catch-all domains, which often absorb messages but never deliver them. It also identifies disposable email domains—common in spam campaigns or bot signups—that signal low intent or high churn. Using bulk verification or the real-time API lets you clean your list before it touches your email service provider.

SMTP servers don’t care if the token expired—they care if the address is valid. By catching these issues early, you reduce the load on your delivery infrastructure, reduce bounce rates, and improve inbox placement. It’s not a silver bullet, but it’s a necessary layer when you’re managing scale.

For context, the RFC 5321 specification outlines how email servers should handle rejected addresses and authentication failures, making clear that both technical and data hygiene issues must be resolved to ensure consistent delivery. IETF RFC 5321 details the SMTP protocol’s expected behavior—validating the recipient is a core step, whether the token is fresh or not.

How Emaillistchecker.io helps reduce 535 errors indirectly

You can’t prevent 535 authentication errors in your email delivery SDK by directly managing session tokens, but you can reduce the number of such failures by pruning invalid, role-based, and disposable email addresses before sending. Emaillistchecker.io doesn’t handle SMTP sessions or token refresh logic, but its verification engine reduces delivery stress on your SDKs by filtering out addresses that are likely to trigger auth errors—even if the domain’s policy is strict. By catching these failures early, you stop wasting SMTP attempts on addresses that would otherwise fail with a 535 status due to rejected authentication.

Reducing load from invalid and high-risk addresses

When your SDK sends to a list with high volumes of invalid or role-based emails—like admin@, sales@, or no-reply@—you increase the chance of hitting authentication errors, even on domains with proper setup. These addresses often trigger SMTP 535 errors not due to your auth method, but because the receiving server rejects messages from non-unique roles. Emaillistchecker.io identifies these problematic formats and flags them as risky or invalid, allowing you to filter them before they reach your delivery pipeline.

The impact is measurable: fewer failed attempts mean less strain on your connection pool, lower odds of being temporarily throttled or blocked by receiving servers, and a more predictable delivery flow. A study by Return Path found that lists with 10% or more invalid addresses see a significant drop in inbox placement, even with proper authentication in place. By removing these addresses in advance, you’re not fixing your SDK’s handshake—it’s not even trying to authenticate for those addresses at all.

Identifying domains with strict authentication policies

Some domains enforce aggressive authentication checks, including requiring DKIM, SPF, and strict DMARC policies, which can result in 535 errors even when credentials are otherwise valid. Emaillistchecker.io’s inbox placement testing simulates real delivery to domains and highlights those with high rejection rates under strict auth rules. This allows you to adjust your SDK’s strategy—such as increasing retries, adding proper authentication headers, or excluding certain domains altogether—before you send at scale.

Let’s say a domain consistently rejects messages from your IP, not because of your credentials, but because it only accepts traffic from verified partners. The inbox placement test surfaces this in advance, giving you time to either adapt your sending strategy or skip the domain entirely. This level of insight isn’t about fixing your SDK’s session logic—it’s about avoiding the pitfalls it can’t control by design.

Use our bulk verification to clean your list ahead of send, or try our inbox placement testing to assess how your messages would land across real domains. Both tools reduce the likelihood of SMTP 535 errors by eliminating the source of failure before it occurs.

Can you auto-refresh tokens using Emaillistchecker.io?

No. Emaillistchecker.io does not handle session tokens, authentication flows, or API session management. It’s not a delivery or authentication layer. Its role is strictly in verifying email address validity, identifying invalid or risky addresses, and cleaning your list before sending—ensuring you’re not even attempting to deliver to known bad domains, which can trigger 535 errors.

What Emaillistchecker.io actually does

You can’t auto-refresh tokens with Emaillistchecker.io because it doesn’t issue or manage them. Instead, it acts as a gatekeeper for your email list, checking each address against real-time data like syntax, domain validity, and inbox availability. It identifies common red flags—catch-all domains, disposable email addresses, invalid syntax—before they reach your delivery provider.

Using it helps prevent 535 errors indirectly. A 535 error typically means "Authentication credentials were rejected," often triggered when sending to domains with strict policies or poorly configured SMTP servers. Sending to such domains—especially if they’re known to reject mail or have outdated MX records—can flag your sender reputation and break delivery pipelines.

How to use verification to block 535s upstream

Let’s say your list includes addresses from an old domain that recently changed its authentication policy. If you send without verification, your SMTP server may attempt delivery—only to be rejected with a 535 due to mismatched credentials or a blocked sender. Emaillistchecker.io catches that during bulk verification by flagging the domain as invalid or risky.

Integrating Emaillistchecker.io into your pipeline—via the real-time verification API or bulk verification—lets you filter out those problem addresses before they ever reach your send engine. This isn’t about refreshing authentication tokens; it’s about preventing attempts to send to destinations that will reject your message regardless of token state.

A 2022 report from RFC 5321 confirms that SMTP servers return 535 when authentication fails, but also notes that many deliveries fail not due to token issues, but because of invalid or unreachable domains. Cleaning your list with a tool like Emaillistchecker.io reduces those failure points. According to industry data, even a 1–2% improvement in list hygiene reduces bounce rates by nearly 15%, directly lowering rejection incidents including 535 responses.

What happens if you ignore session token refresh in your SDK?

If you skip session token refresh in your email delivery SDK, your sends will start failing unpredictably after tokens expire—commonly marked by 535 authentication errors. These failures disrupt delivery, delay messages, and eventually harm your sender reputation. Mail servers notice inconsistent delivery patterns, which can signal weak infrastructure or poor maintenance. Let’s break down the real-world impact.

Immediate technical consequences

Intermittent 535 errors occur when expired tokens trigger authentication rejection at the SMTP server—your SDK can’t send without a valid session, and you won’t know when it happens until logs show it.
Each failed send forces your SDK to retry, often with backoff delays—adding latency that can push delivery beyond acceptable thresholds.
Without proactive refresh, you’re relying on the fallback retry logic of the underlying email provider (like SendGrid or Amazon SES), which may not be optimized for your use case.

Long-term reputation and deliverability risks

Mail servers track consistency. Repeated, non-uniform failure patterns—especially around specific time windows or large batches—can trigger reputation penalties.
An inconsistent sending profile may lead to increased scrutiny from blacklist services like Spamhaus, even without outright listing. A single failed delivery doesn’t hurt, but thousands over time do.
Reputation systems like Return Path's Sender Score use delivery failure rates as a signal. If your SDK can't manage tokens, your sending volume and success rate start to drift—making it harder to stay out of the spam quarantine zone.

Even if the 535 error seems temporary, the root cause is preventable. RFC 5321 (the SMTP standard) requires proper authentication state management—ignoring it makes your stack less reliable over time [RFC 5321]. You don’t have to accept intermittent failures as "normal." You can verify that your list is clean and free of invalid recipients—reducing the chance of hitting a dead end during delivery—using email verification tools. For instance, before sending high-volume campaigns, run your list through a bulk verification process to identify and exclude problematic addresses early.

The real cost of 535 errors: beyond delivery failure

Each 535 error—authentication failure—signals to receiving servers that your email infrastructure is either misconfigured or compromised. This can trigger automated defenses, even if your mailing list is valid.

Repeated failures increase the likelihood of your IP or domain being added to blocklists. Once listed, even low-volume sends face high rejection rates, regardless of content quality or list hygiene.

Even without spam triggers, persistent 535 errors erode sender reputation. Lower reputation means lower inbox placement, directly impacting engagement and delivery effectiveness. This isn't just about failed deliveries—it's about long-term deliverability health.

Sources

Since June 2024, bulk senders with a user-reported spam rate above 0.3% are ineligible for Gmail delivery mitigation. — Google Email Sender Guidelines FAQ (2024)

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does SMTP 535 error mean?

It means the server rejected the authentication attempt—usually due to expired, incorrect, or missing credentials.

Can a bad email address cause a 535 error?

No. 535 errors are related to server authentication, not email validity. Invalid addresses cause 550 or 553 errors.

How often should session tokens be refreshed?

Ideally 2–3 minutes before expiry. Most tokens last 10–15 minutes.

Does Emaillistchecker.io fix 535 errors?

No. It does not manage authentication or tokens. It improves deliverability by ensuring your list is clean.

Can poor sender reputation cause 535 errors?

Not directly. But repeated failures due to expired tokens can contribute to a poor sender reputation over time.

What is the best way to test if token refresh works?

Simulate a token expiry and verify that the SDK fetches a new one automatically before sending.

Do all email providers use session tokens?

Modern APIs and SMTP providers use short-lived tokens. Some legacy systems rely on static credentials.

How does list hygiene affect 535 errors?

It reduces the frequency of failed attempts overall, but does not prevent 535 errors caused by expired credentials.

Is auto-refresh required for every email SDK?

Yes, if the SDK uses time-limited credentials. It’s a foundational requirement for reliable delivery.

Can you use Emaillistchecker.io with SendGrid or Mailgun?

Yes. You can verify your list before sending via SendGrid or Mailgun. Their delivery SDKs handle token refresh independently.