Q: Refresh tokens expire on GoDaddy but not on local server using OAuthAuthorizationServerProvider I have created some websites that use token based authentication and I am hosting them on GoDaddy.
The authentication is using  Microsoft.Owin.Security.OAuth.OAuthAuthorizationServerProvider. The code for the authentication can be found here: https://github.com/quintonn/BasicAuthentication
Now my problem is as follows:
When I log in using a username and password i get an access and refresh token. These work as i can get a new access token if the refresh token is still valid. It seems that everytime i deploy new code to the server, all refresh AND access tokens become invalid and any user using my website has to log in again. I have tried to replicate this on my dev machine but restarting it, running IIS RESET, but on my local machine, i'm still logged in.
Weirdly, the error I see (in Dev tools), is just "{invalid_grant}" with no reason or more information. This is no where in my code and i can't figure out what is wrong with my request and why this only happens on my website hosted on GoDaddy.
If anyone has any ideas or suggestions, that would be great.
Thanks in advance.

A: By default tokens are signed by the owin host's protection key. In SystemWeb hosting, that protection key is the machineKey setting from web.config.
When received, the same code is used to decode the token. On your dev machine this code never changes. I do not know how GoDaddy works, but it seems that every deploy is on another (virtual) machine (webfarm?).
As soon as the machine key changes, the tokens can no longer be decoded. Thus requiring all users to login again. The error 'invalid grant' is part of the underlying identity flow that is responsable for decoding and evaluating the received token.
In order to solve this problem you'll have to set a fixed code in the configuration.
