Unknown client ID or redirect URI not registered exactly. Check both in Developer Portal.
Secure state value required
State missing or fails server format checks. Generate a fresh high-entropy URL-safe state.
PKCE S256 challenge required
Missing/invalid challenge or method. Generate a fresh S256 challenge.
User denied access
The user declined consent; return to your app without creating a session.
Token and UserInfo failures
Observed condition
Likely cause and fix
Required token fields (422)
Provide client ID, code, redirect URI, and original verifier.
Invalid client credentials (401)
Check registration and any server-held secret; never expose a secret in public code.
Invalid or expired authorization code (401)
Code expired, was consumed, or does not match client/redirect URI. Start a fresh login.
Invalid PKCE code verifier (401/422)
Verifier malformed or not the one that produced the challenge. Restart the transaction.
User access token required / invalid or expired (401)
Send a valid Bearer access token to UserInfo, or reauthenticate.
Client-side state mismatch
State validation is your callback's responsibility. If it does not match your saved transaction, reject the callback; do not exchange the code. Avoid logging raw codes or tokens while diagnosing errors.
