Microsoft (Outlook.com and Microsoft 365) · permanent error
535 5.7.143: HVE: OAuth token expired
The application tried to authenticate to HVE with an OAuth access token that had already expired.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 535 5.7.143
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
535 5.7.143 XOAUTH2 authentication failed. Expired token.
What it means
When an application authenticates to an HVE account with XOAUTH2, Exchange Online checks the access token's validity. An expired token gets 535 5.7.143, and the session cannot send. The fix is in the application: regenerate the token so it is valid when used, and make token refresh part of the sending process so the application never relies on a stale cached value.
Common causes
- The application cached a token and used it after it expired.
- The token refresh step failed or was skipped.
How to fix it
- 01Regenerate the user token and authenticate again.
- 02Check that the application refreshes tokens on schedule and handles refresh failures.
- 03Log token expiry times so you can see when a stale token is used.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
Related codes
- 535 5.7.142HVE: OAuth token about to expire.The OAuth access token an application used to authenticate to HVE was close to expiring, so Exchange Online rejected it.
- 535 5.7.144HVE: app lacks the right API permissions.The OAuth token came from an app registration whose API permissions do not allow it to use HVE, so authentication failed.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce