Getting 401 Unauthorized immediately after token refresh — clock skew?

Hey everyone,

Running into a weird issue with our Genesys Cloud integration. We’ve got a Node.js service handling OAuth2 client credentials flow. Everything works fine for the first few minutes. Then, as soon as the access token expires and the service fetches a new one, the very first API call fails with a 401.

Here’s the kicker: if I wait about 10-15 seconds and retry the exact same request, it works. The new token looks valid in the response payload too.

We’re running this on an AWS EC2 instance in us-west-2. Genesys Cloud is obviously cloud-hosted. Could there be a clock skew issue between our instance and the auth server? Or is the SDK not waiting for the token to be “active”?

Here’s the relevant snippet from our token refresh logic:

async function refreshToken() {
 try {
 const response = await axios.post('https://api.mypurecloud.com/oauth/token', {
 grant_type: 'client_credentials',
 client_id: process.env.GC_CLIENT_ID,
 client_secret: process.env.GC_CLIENT_SECRET
 });
 
 // Storing in memory cache
 currentToken = response.data.access_token;
 lastRefreshTime = Date.now();
 
 return currentToken;
 } catch (error) {
 console.error('Token refresh failed:', error.response.data);
 throw error;
 }
}

And the failing request:

// This happens right after refreshToken() returns
const headers = {
 'Authorization': `Bearer ${currentToken}`,
 'Content-Type': 'application/json'
};

const res = await axios.get('https://api.mypurecloud.com/api/v2/users/me', { headers });
// Returns 401 { "code": "unauthorized", "message": "Invalid or expired token" }

The expires_in is 3600. I checked the server time on EC2 using timedatectl and it looks synced within milliseconds.

Has anyone seen this? Should I add a small delay after refresh, or is there a better way to handle the token state?

Thanks for the help.