ShotGrid OAuth and CI/CD Pipeline Token Lifecycle Integration

Direct Answer

ShotGrid does not publicly document whether refresh tokens are automatically invalidated when a user changes their password or resets credentials. Based on OAuth 2.0 patterns and the absence of explicit confirmation, you should assume refresh tokens remain valid until explicit revocation or natural expiration. This means automated pipelines can continue operating with stale credentials unless you implement defensive monitoring.

What Is Confirmed vs. Assumed

Aspect	Status
Access token expiry (typically 1 hour)	Confirmed via OAuth 2.0 spec
Refresh token issuance during authorization code flow	Confirmed
Automatic refresh token revocation on password change	Not documented — assume no
Manual revocation via ShotGrid UI or API	Available (Applications page)
Token introspection/revocation endpoint	Standard OAuth 2.0 endpoints exist

Recommended CI/CD Pipeline Safeguards

1. Implement proactive token refresh — Refresh access tokens 5–10 minutes before expiry using the refresh token. Do not wait for 401 responses.
2. Monitor for 401/403 on every API call — Treat any authentication failure as a signal to re-run the full OAuth flow (re-authorize user) rather than just refreshing.
3. Store refresh tokens securely — Use your CI/CD secret manager (GitHub Actions secrets, GitLab CI variables, Vault, etc.). Never commit them.
4. Add a periodic validation job — Run a lightweight API call (e.g., /api/v1/entity/Projects with fields=id) on a schedule to detect silent token invalidation.

Verification Steps for Your Environment

Since behavior may vary by ShotGrid version or subscription tier, run this one-time test on a non-critical service account:

# 1. Obtain a refresh token via OAuth flow
# 2. Change the service account password in ShotGrid
# 3. Attempt to use the refresh token to get a new access token
curl -X POST https://your-site.shotgrid.autodesk.com/api/v1/auth/access_token \
  -d grant_type=refresh_token \
  -d refresh_token=YOUR_REFRESH_TOKEN \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET

If the request returns a new access token, the refresh token survived the credential change. If it returns invalid_grant or similar, automatic invalidation occurred.

One Diagnostic Detail Needed

What ShotGrid platform version are you running (cloud vs. on-premise, and version number)? Cloud instances receive updates automatically; on-premise deployments may have different token policies. This changes whether you can rely on current behavior or need a version-specific workaround.