ERR_FRESHBOOKS_AUTH on FreshBooks: FreshBooks authentication failed — a connected app cannot refresh its access token or the FreshBooks API rejects the request as unauthorised. Root cause: FreshBooks authentication failures normally occur when an OAuth access token has expired and its refresh token cannot be exchanged, when the connected FreshBooks user no longer has access to the business being queried, or when the OAuth application configuration no longer matches the integration callback URL. A successful sign-in screen is not enough: the connection must be authorised for the correct FreshBooks account and business, and the integration must keep the returned refresh token instead of repeatedly reusing an expired access token. Step 1: Read the response code and isolate the failing connection. Open the failed automation run and identify whether FreshBooks returned 401, 403, or an OAuth invalid-grant style response. A 401 generally means the access token is invalid or expired; a 403 usually means the authenticated user lacks access to the business or resource. Check that only the FreshBooks connection is failing, rather than every step in the workflow, before you reset credentials. Step 2: Reconnect with the owner or authorised accountant for the correct business. Disconnect the broken FreshBooks connection in the integration platform, then reconnect it using a FreshBooks user who has active access to the target business. During authorisation, check the selected business carefully if the user belongs to multiple organisations. A bookkeeper may successfully authorise the app but still receive permission errors if they do not have the necessary role for invoices, clients, expenses, or reports. Step 3: Verify the OAuth app callback URL and client configuration. If you maintain a custom integration, compare the redirect URI configured in the FreshBooks developer application with the callback URL sent by your app character-for-character, including HTTPS and any trailing path. Confirm that the client ID and secret belong to the same environment. A production app using sandbox credentials, or a callback URL changed during a deployment, can produce an authentication failure immediately after users consent. Step 4: Confirm token refresh is persisted after every successful exchange. FreshBooks OAuth connections rely on short-lived access tokens and renewable refresh tokens. Your application must store the latest token pair after a refresh and use the new refresh token on the next renewal. If several workers refresh the same connection concurrently, one can invalidate the token used by another. Use a single token-refresh lock per FreshBooks connection and log the refresh timestamp without logging the token itself. Step 5: Test a low-risk endpoint before replaying financial writes. After reconnection, use a read-only operation such as listing a small set of clients or checking the business profile. Confirm that the returned business ID matches the one used in your invoice or expense mappings. Only then replay a failed write. This avoids posting an invoice into the wrong FreshBooks business when an owner has access to more than one organisation. Step 6: Reconcile the failed window and protect against double-posting. Review the failed-run window and list the invoice or expense source IDs that may not have reached FreshBooks. Before replaying, search FreshBooks for each external reference or invoice number. Update existing records where available and create only records that are absent. Add a durable source-system ID or unique reference to future payloads so an expired-token retry cannot create duplicate financial documents.