OAuth token refresh failing with 401 during high-concurrency JMeter load test

Quick question, has anyone seen this weird error? with the authentication flow when scaling up our load tests. We are trying to simulate a burst of 200 concurrent agents logging in via the WebRTC softphone to validate connection stability on our BYOC Edge in the Asia/Singapore region. The setup uses Genesys Cloud Platform API v2 for initial token acquisition.

The issue is intermittent but consistent after the first minute of the test. The initial POST /api/v2/oauth/token calls succeed, but when the load spikes, the subsequent token refresh requests start failing. The JMeter logs show a sudden spike in 401 Unauthorized errors, specifically on the refresh endpoint.

Status Code: 401 Response Message: Unauthorized Response Body: {"error":"invalid_grant","error_description":"Refresh token has expired or is invalid"}

This is strange because the refresh tokens should be valid for 24 hours. I checked the JMeter config, and we are using a CSV Data Set Config to distribute unique agent credentials, so there is no credential reuse. The test runs on a local machine with Java 17. I have verified that the client ID and secret are correct by running a single-threaded test, which works perfectly fine.

I suspect there might be a rate limit on the OAuth endpoint that is not documented clearly, or perhaps the token service is rejecting requests that arrive too closely together from the same IP range. The x-gw-ims-org-id header is being passed correctly. I am not seeing any 429 Too Many Requests responses, just 401s.

Has anyone dealt with OAuth token invalidation during high-throughput load testing? Is there a specific header or parameter I am missing to ensure the refresh tokens remain valid under load? I am new to this scale of testing, so any insights on how the Platform API handles concurrent auth requests would be helpful.

The official documentation states the token endpoint has strict rate limits per client ID.

Check if your JMeter script is hitting the same IP range. Rotate user-agents or stagger the requests to avoid triggering the WAF.

You need to stagger the token refresh requests to avoid triggering the platform’s rate limiting mechanisms. The 401 errors during high concurrency are typically a protective measure against excessive load on the authentication service.

The root of the issue is that bulk export jobs and legal hold integrations often share the same underlying authentication infrastructure, so high-concurrency bursts from load tests can exhaust token caches before the refresh mechanism catches up. Try implementing an exponential backoff in your JMeter script specifically for the /oauth/token endpoint to prevent triggering the platform’s protective 401 responses during the initial burst.