How to Fix Facebook Error Code 190

By FixMyError · Updated October 17, 2026 · 6 min read

What error code 190 means

Facebook does not send your password back and forth every time you tap something. Instead, when you log in, Facebook hands your app or browser an access token — a digital pass that proves you are signed in and lets the app make requests on your behalf. Error code 190 is Facebook's standardized way of telling you that this pass has been rejected: it is expired, it was revoked, or it belongs to a session Facebook no longer trusts.

On the surface it looks a lot like a plain "session expired" message, but code 190 is more specific. Facebook attaches a subcode that pinpoints the cause: 463 means the token simply expired, 460 means your password changed (which revokes old tokens by design), 458 means the app's permission was removed or the app was uninstalled, and 464 means Facebook invalidated the token during a security checkpoint. Most of the time you only see the main code, though — "error code: 190" — and the fix is the same family of remedies: get a brand-new token and remove whatever keeps corrupting or revoking it.

You can also run into this code outside the Facebook app. Any third-party app or game that uses "Log in with Facebook" relies on the same token system, so a dead Facebook token shows up as error 190 in those apps too. The good news: fixing the token on Facebook's side — signing out everywhere and signing back in, or resetting your password — usually clears it in the connected apps as well, without touching each app individually.

Common causes

• Expired access token: tokens go stale after long periods of inactivity or old app sessions.
• Password changed recently: changing your password revokes all existing tokens by design.
• App permission removed or app uninstalled: removing the Facebook app or revoking its login permission invalidates the token.
• Security checkpoint on the account: suspicious-login detection can invalidate tokens as a precaution.
• Corrupted cached token data or outdated app: damaged local session files or old app versions mishandle token refresh.

How to fix error code 190 — step by step

Work through these fixes in order, testing the app after each one.

1. Force-close Facebook and log out, then log back in. Start by getting a fresh token. On Android, open the recent-apps view and swipe Facebook away; on iPhone, swipe up from the bottom and dismiss the app card. Reopen it and sign out completely: tap the menu, then Settings & privacy, then Settings, and scroll to Log out. In a desktop browser, click your profile picture and choose Log out. Then sign back in with your current password. If you are signed in on other phones or computers, repeat the sign-out there too, or end them remotely from Settings, then Accounts Center, then Password and security, then "Where you're logged in." One clean login issues a new valid token and usually ends the error immediately.
2. Clear the Facebook app cache or reinstall. If logging back in only buys you a few hours before error 190 returns, the token stored on your device is likely corrupted. On Android, go to Settings, then Apps, then Facebook, then Storage, and tap "Clear cache" first — if the error persists, tap "Clear data" (also labeled "Clear storage" on some phones), which wipes the app's saved login state entirely. On iPhone, there is no per-app cache clear: delete the Facebook app, restart your phone, and reinstall it from the App Store. Sign back in and check whether the error is gone.
3. Update the Facebook app. Open the Google Play Store or Apple App Store, search for Facebook, and install the latest update. Token refresh and session handling are fixed regularly in updates, and an app that is months behind is a common source of recurring 190 errors. Turn on auto-updates so you do not fall behind again.
4. Set your device date and time to automatic. Access tokens are time-stamped, and Facebook's servers reject them when your device clock drifts too far from the real time — a single wrong-timezone setting can silently kill every new token. On Android, open Settings, then System, then Date & time, and enable "Set time automatically." On iPhone, go to Settings, then General, then Date & Time, and turn on Set Automatically. On a computer, enable automatic time sync in your operating system's clock settings. Then sign into Facebook again and test.
5. Reset your Facebook password. If you changed your password recently and chose "log out of all devices," every old token died by design — and anything still holding one will keep throwing error 190. Even if you did not change it, a password reset is a clean way to kill every stale token at once: go to facebook.com/login/identify, enter the email or phone number on your account, and follow the identity-verification steps to set a new, strong password. Then sign in with the new password on each device so every session is rebuilt from the current credentials.
6. Disable VPNs, ad blockers, and cleaner apps. Tools that sit between Facebook and your network can strip, rewrite, or delete the session data your token depends on. Temporarily disable any VPN, ad-blocking app, or privacy extension, and remove or pause "phone cleaner," battery-saver, or optimization apps that aggressively clear other apps' data — whitelisting Facebook in them is even better. Then switch to a stable connection (home Wi-Fi rather than public hotspot) and sign in once more. If the error disappears with these tools off, you have found the culprit.

Did this fix it? Quick checklist

• Facebook stays signed in for days with no error 190
• Connected apps using "Log in with Facebook" open without the error
• Your device clock is set to automatic
• No unrecognized devices appear in your login sessions

If error 190 keeps coming back, sign into facebook.com in a browser and check for any security checkpoint, "unusual login" warning, or identity-verification prompt — these silently invalidate tokens until you complete them. While there, review "Where you're logged in" for devices you do not recognize and remove them, then enable two-factor authentication in Accounts Center, then Password and security, so future tokens are tied to a better-protected account.