Connections, auth and API

Why does my integration fail with invalid_grant, insufficient access or KISSFLOW_ERROR_10220?

Reauthenticate the connection with an active account that has admin access to every flow the integration touches, ideally a service account.

Fix

Short answer: Each step runs with the credentials of the account behind its connection. Reauthenticate the connection with an active account that has enough access to every flow the integration uses.

Why it happens

  • The user who created the connection was deactivated or removed, or their access key was deleted, expired or turned off.
  • The connection account doesn't have enough access to the process, board or dataset used in a step.
  • The step writes to fields that are read-only at the item's current step (KISSFLOW_ERROR_10220, "You cannot specify…").
  • The third-party admin blocked the app or didn't grant the scopes it needs.

How to fix it

For invalid_grant, expired keys or a deactivated connection owner:

  1. Open the failing action and go to its authentication settings.
  2. Reconnect with an active account, or click Re-authenticate connection on the Connections tab. See Re-authenticate your connections.
  3. Hold long-lived connections on a service account so they don't depend on one person.
  4. Before you deactivate a user who owns connections, share the connections with another admin and move them over.

For "insufficient access" or "You don't have permission to access this resource":

  1. Give the connection account admin access to every process, board and dataset used in the steps.

For KISSFLOW_ERROR_10220:

  1. Check that you mapped the board or process you mean to update.
  2. Check which listed fields are read-only at that step. Update the status and the fields together in one Update an item action.

For Gmail "insufficient authentication scopes" or other third-party errors:

  1. Edit the action, click Refresh fields, and test again. If it still fails, reauthenticate the connection.
  2. Fix the permission in the other system. For example, ask your Google Workspace admin to allow the app, or ask your Microsoft admin to approve the pending request in Entra ID.
  3. For email actions, sign in with the account you want to send from.

Important

Deleting an access key revokes every connection created with it. If reauthentication fails for every user, contact Kissflow support.

Related answers