Go to developer

invalid_grant

Authorization code exchange failed (code, PKCE, redirect, or reuse).

On this page
HTTP 400oauthoauthapitypescriptwebjava

Code: invalid_grant · Shape: oauth

Meaning

Authorization code exchange failed (code, PKCE, redirect, or reuse).

Likely causes

  1. Authorization code already used or expired
  2. code_verifier does not match the challenge from start
  3. redirect_uri differs between start and token
  4. Wrong code for this client

How to diagnose

  • Confirm the same PKCE verifier from the start of this login
  • Confirm redirect_uri identical to authorize/start
  • Ensure code is exchanged once, immediately

How to fix

  • Restart the OAuth flow and generate PKCE once per login
  • Persist verifier across redirect (do not regenerate before exchange)

Retry behavior

Do not retry the same authorization code. Start a new login.

API: POST /oauth/token

SDK: exchangeAuthorizationCode(), handleRedirectCallback(), generatePkce(), generatePkce()

Troubleshooting: pkce, oauth

Guides: Token exchange, PKCE