The difyctl authentication suddenly expired.

### Self Checks

- [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542).
- [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).
- [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones.
- [x] I confirm that I am using English to submit this report, otherwise it will be closed.
- [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
- [x] Please do not modify this template :) and fill in all the required fields.

### Dify version

1.15.0

### Cloud or Self Hosted

Self Hosted (Docker)

### Steps to reproduce

We have configured dify as follows:
ACCESS_TOKEN_EXPIRE_MINUTES=60
REFRESH_TOKEN_EXPIRE_DAYS=1825

We hope that after users log in to dify and authorize difyctl, they will not need to authorize again for a long time.

But suddenly, difyctl became unavailable, and using any function resulted in a 500 error.
After re-authenticating with auth login, it returned to normal.
We believe this is completely unexpected, as it interrupted normal usage.

this is error:

C:\Users\l00621014>difyctl get app
✖ Fetching apps
internal_server_error: Internal Server Error
request: GET http://hi-btc-ai.rnd.huawei.com:18190/openapi/v1/apps?workspace_id=99023474-1b4d-4b78-b45d-f42cd53993e4&page=1&limit=20
http_status: 500

the dify-api get error：

```
2026-09-10 20:30:17.960 ERROR [Dummy-83297] [app.py:875] 627d9e2304ee5fedaedc4cb0e05e134e - Exception on /openapi/v1/apps/ed84dc6a-f456-4abf-83f7-e69fc647bcae/describe [GET]
Traceback (most recent call last):
File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 917, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 902, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/api.py", line 404, in wrapper
resp = resource(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask/views.py", line 110, in view
return current_app.ensure_sync(self.dispatch_request)(**kwargs) # type: ignore[no-any-return]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/resource.py", line 41, in dispatch_request
resp = meth(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/app/api/controllers/openapi/auth/pipeline.py", line 178, in decorated
return self._execute(
^^^^^^^^^^^^^^
File "/app/api/controllers/openapi/auth/pipeline.py", line 220, in _execute
identity = get_authenticator().authenticate(token)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/libs/oauth_bearer.py", line 292, in authenticate
raise InvalidBearerError("invalid_bearer")
libs.oauth_bearer.InvalidBearerError: invalid_bearer
2026-09-10 20:30:18.158 ERROR [Dummy-83298] [app.py:875] f720a478c9ca50d7b0934acc76821566 - Exception on /openapi/v1/apps/cb0ab208-33b9-4c68-9822-6353967e0dd3/describe [GET]
Traceback (most recent call last):
File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 917, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask/app.py", line 902, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/api.py", line 404, in wrapper
resp = resource(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask/views.py", line 110, in view
return current_app.ensure_sync(self.dispatch_request)(**kwargs) # type: ignore[no-any-return]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/.venv/lib/python3.12/site-packages/flask_restx/resource.py", line 41, in dispatch_request
resp = meth(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/app/api/controllers/openapi/auth/pipeline.py", line 178, in decorated
return self._execute(
^^^^^^^^^^^^^^
File "/app/api/controllers/openapi/auth/pipeline.py", line 220, in _execute
identity = get_authenticator().authenticate(token)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/app/api/libs/oauth_bearer.py", line 292, in authenticate
raise InvalidBearerError("invalid_bearer")
libs.oauth_bearer.InvalidBearerError: invalid_bearer
```

### ✔️ Expected Behavior

After difyctl authorization, if used again within the time specified by REFRESH_TOKEN_EXPIRE_DAYS, it will not expire.

### ❌ Actual Behavior

The authorization for difyctl has suddenly expired and it cannot be used.

Start with api/controllers/openapi/auth/pipeline.py and api/libs/oauth_bearer.py, following the authentication path shown in the traceback, then inspect how difyctl refreshes and sends tokens. Reproduce the failure using the reported expiration settings and verify that continued use within REFRESH_TOKEN_EXPIRE_DAYS does not produce invalid_bearer or a 500 response.

Written by the indexing model from the issue text.