Go to developer

invalid_state

Callback state does not match the value stored in the browser transient (CSRF protection).

On this page
Clientsecurityoauthweb

Code: invalid_state · Shape: sdk_client

Meaning

Callback state does not match the value stored in the browser transient (CSRF protection).

Likely causes

  1. sessionStorage cleared mid-flow
  2. Callback opened in a different browser profile/storage partition
  3. Stale tab completing an old flow

How to diagnose

  • KeyraOAuthError invalid_state from Web SDK.
  • Confirm same browser storage for start and callback.

How to fix

  • Restart verifyWithRedirect.
  • Avoid clearing storage between start and callback.

Retry behavior

Restart the flow.

SDK: handleRedirectCallback()

Troubleshooting: popup-redirect, pkce

Guides: Redirect flow, OAuth Security