Pavlovia authentication token expires every day – PsychoPy 2026.2.4

Builder
1

OS (e.g. Win10):
PsychoPy version (e.g. 2024.2.4 Py 3.8):

Hi,

I’m having a recurring authentication problem with Pavlovia in PsychoPy 2026.2.4 on Windows.

Every day, when I try to use my Pavlovia project, I get the following error:

Traceback (most recent call last):
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\ribbon.py", line 917, in onClick
    project = self.GetTopLevelParent().project
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\builder\builder.py", line 1692, in project
    return pavlovia.getProject(self.filename)
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy\projects\pavlovia.py", line 1593, in getProject
    session = getCurrentSession()
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy\projects\pavlovia.py", line 1707, in getCurrentSession
    _existingSession.doRefreshToken()
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy\projects\pavlovia.py", line 526, in doRefreshToken
    raise gitlab.GitlabAuthenticationError(
gitlab.exceptions.GitlabAuthenticationError: invalid_grant: The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.

The workaround is to close PsychoPy, delete the pavlovia folder from:

%APPDATA%\PsychoPy3

and then log into Pavlovia again. This fixes the problem temporarily, but the exact same error comes back the next day.

Is anyone else experiencing this? In particular, does anyone know why the refresh token is becoming invalid again after approximately one day, or whether there is a known issue with the current PsychoPy/Pavlovia/GitLab authentication?

I’d appreciate any advice on a permanent fix, as having to delete the Pavlovia credentials and log in again every day is becoming quite disruptive.

Thanks!

2

Hi,

I got this recently and it was fixed with a reboot, without having to delete anything.

Traceback (most recent call last):

  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\_psychopyApp.py", line 907, in showBuilder
    self.newBuilderFrame()
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\_psychopyApp.py", line 887, in newBuilderFrame
    self.builder = BuilderFrame(None, -1,
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\builder\builder.py", line 196, in __init__
    self.ribbon = BuilderRibbon(self)
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\builder\builder.py", line 4688, in __init__
    self.addPavloviaUserCtrl(
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\ribbon.py", line 185, in addPavloviaUserCtrl
    btn = self.sections[section].addPavloviaUserCtrl(name=name, ribbon=self, frame=frame)
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\ribbon.py", line 383, in addPavloviaUserCtrl
    btn = PavloviaUserCtrl(self, ribbon=ribbon, frame=frame)
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\ribbon.py", line 759, in __init__
    self.updateInfo()
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy_app\ribbon.py", line 825, in updateInfo
    user = pavlovia.getCurrentSession().user
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy\projects\pavlovia.py", line 1707, in getCurrentSession
    _existingSession.doRefreshToken()
  File "C:\Program Files\PsychoPy\lib\site-packages\psychopy\projects\pavlovia.py", line 526, in doRefreshToken
    raise gitlab.GitlabAuthenticationError(
gitlab.exceptions.GitlabAuthenticationError: invalid_grant: The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.

I asked @TParsons who said that he had seen it too, but hasn’t been able to replicate it reliably.

Do you close PsychoPy overnight? If we can work out how to recreate the error, it should be possible to fix.

3

To be clear, tokens expiring after 2 hours is the intended behaviour; this is something GitLab (which Pavlovia runs on) does for security and is actually pretty important. What’s going wrong here isn’t that the token is expiring, it’s that it isn’t being automatically renewed.

What should happen is that when you log in, you’re issued an authentication token (which expires after 2 hours) and a refresh token (which PsychoPy uses behind the scenes to get a new authentication token when yours expires, without forcing you to login again). What seems to be happening is that your refresh token is becoming invalid, how and when that’s happening is what we’re trying to figure out.