# rpc error: code = PermissionDenied desc = invalid auth token

- **ID:** `go/grpc-permission-denied-auth-token`
- **Domain:** go
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The authentication token provided in the gRPC metadata is invalid or expired.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 1.56.x | active | — | — |
| 1.57.x | active | — | — |

## Workarounds

1. **** (90% success)
   ```
   token, err := refreshToken(); if err != nil { log.Fatal(err) }; md := metadata.Pairs("authorization", "Bearer "+token)
   ```
2. **** (85% success)
   ```
   interceptor := func(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error { token := getValidToken(); ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+token); return invoker(ctx, method, req, reply, cc, opts...) }
   ```
3. **** (95% success)
   ```
   if token.Expiry.Before(time.Now()) { token, err = refreshToken() }
   ```

## Dead Ends

- **Continuing to use the same expired token.** — Token is still invalid. (100% fail)
- **Using a static test token in production.** — Security risk and may not be valid in production. (80% fail)
- **Removing the token from metadata.** — Server requires authentication. (90% fail)