Fix OAuth Token Replay Attack Detected in Azure AD
This error means Azure caught a reused token. The fix is clearing old tokens or updating your app registration. Here's how.
You got the OAuth token replay error. Annoying, but fixable.
This error (AADSTS500133) hits when Azure AD thinks someone stole and reused your token. Usually it's a false alarm — your app or browser held onto an old token too long. Let me show you how to kill it.
The real fix: clear cached tokens
Most times the problem is stale tokens sitting in your browser or app cache. Here's what to do:
- Clear browser cache and cookies — Open Chrome/Firefox/Edge and delete all data for the site. On Chrome: Settings → Privacy and security → Clear browsing data. Check 'Cookies and other site data' and 'Cached images and files'. Time range: All time.
- Sign out of all sessions — Go to
https://login.microsoftonline.com/logoutor sign out of the app manually. Then close all tabs. - Restart the app — If it's a desktop or mobile app, fully quit and relaunch it. On Windows, end the process via Task Manager.
This forces a fresh OAuth flow. Azure issues a new token with a unique ID, so the replay check passes.
Why this works
Azure AD tracks token IDs (the 'jti' claim). When you reuse a token it already saw, it assumes a replay attack. Your browser or app stored an old token from a previous session — maybe you didn't sign out properly, or the token lifetime expired but the app didn't refresh. Clearing cache removes the stale token, so the next request uses a fresh one Azure hasn't seen.
Less common variations
If clearing cache doesn't fix it, check these:
1. App registration mismatch
Sometimes the app's redirect URI or client ID changed. Your token was issued to the old registration. Open the Azure portal → App registrations → pick your app → verify the redirect URI matches the app's current one. If it's wrong, update it and re-auth.
2. Conditional Access policy
Azure AD might be blocking because of a policy that requires device compliance or MFA. Go to Azure portal → Conditional Access → review policies. If a policy applies to your app, try signing in from a compliant device or after completing MFA.
3. Token lifetime settings
If your app uses long-lived refresh tokens, they might get invalidated by Azure's default 90-day limit. Check your app registration's 'Token lifetime' settings (if you have custom ones). For most users, the default 90 days is fine — but if you changed it, reset to default.
4. Custom authentication code
If you're writing your own OAuth flow, you might be reusing the auth code. Microsoft's documentation says each auth code works only once. If your code loops back to the same code, Azure rejects it. The fix: generate a new auth code per request.
Prevention
Stop this from happening again:
- Always sign out properly — use the app's 'Sign out' button, not just closing the tab.
- Keep your app registration settings synced — if you change redirect URIs, update the app too.
- Use short token lifetimes — for development, set tokens to expire in 10 minutes. Production defaults are fine.
- Test with different browsers or incognito mode — isolates cache issues.
Token replay errors are Azure doing its job. The fix is usually simpler than it looks. Get those tokens flushed, and you're back online.
Was this solution helpful?