diff --git a/authn/authenticate.go b/authn/authenticate.go
index a83d552c4..5cc1d64aa 100644
--- a/authn/authenticate.go
+++ b/authn/authenticate.go
@@ -129,6 +129,9 @@ func (a *Auth) Authenticate(ctx context.Context, bearer string) (*UserInfo, erro
 		if err != nil {
 			return nil, errors.Wrap(err, "refreshing token")
 		}
+		if resp.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf("refreshing token: %s", resp.Status)
+		}
 		defer resp.Body.Close()
 		var t oauth2.Token
 		if err := json.NewDecoder(resp.Body).Decode(&t); err != nil {
diff --git a/authn/authenticate_internal_test.go b/authn/authenticate_internal_test.go
index ca60b4c72..305c0af58 100644
--- a/authn/authenticate_internal_test.go
+++ b/authn/authenticate_internal_test.go
@@ -198,7 +198,7 @@ func TestAuthenticate(t *testing.T) {
 			refresh:      true,
 			errOnRefresh: true,
 			exp:          -17764800,
-			err:          fmt.Errorf("decoding refreshed token: invalid character 'b' looking for beginning of value"),
+			err:          fmt.Errorf("refreshing token: 500 Internal Server Error"),
 		},
 	}
 	for _, test := range cases {