Go to developer

Troubleshoot OAuth Verify

Trust boundary, validation, token exchange, and “KEYRA succeeded but I’m not logged in.”

On this page

Browser KEYRA success is not an application session. Always POST /verify/validate on your backend before Set-Cookie.

Popup/redirect completes, but the application has no session.

  1. Browser success ≠ application session
  2. Result never sent to your backend
  3. /verify/validate never called
  4. Validate failed
  5. Backend did not create a session cookie
  • Was the browser result posted to YOUR backend?
  • Did validate return valid?
  • Did your backend map identity and create a session?
  • Was Set-Cookie returned to the browser?
Diagnostic flow
  1. Browser KEYRA success?
  2. Was result sent to YOUR backend?
  3. Was /verify/validate called?
  4. Did validation succeed?
  5. Did your backend map the identity?
  6. Did your backend create a session?
  7. Was session cookie returned?
  • Always validate on the server
  • Create your own session only after validate succeeds
  • See Sessions guide

Related errors: invalid_verification_token, verification_token_already_used, invalid_client

Related SDK: validateVerification(), verifyWithPopup(), handleRedirectCallback()

Related API: POST /verify/validate

Related guides: Server validation, Sessions

Authorization code cannot be exchanged

Symptom

POST /oauth/token fails after hosted success.

Most likely causes

  1. Code reused
  2. redirect_uri mismatch
  3. PKCE mismatch
  4. Code expired

How to diagnose

  • Read invalid_grant error_description.
  • Confirm single exchange.

How to fix

  • Restart login.
  • Align redirect_uri and PKCE.

Related errors: invalid_grant, invalid_client

Related SDK: exchangeAuthorizationCode(), handleRedirectCallback()

Related API: POST /oauth/token

Related guides: Token exchange

Token exchange succeeds but validation fails

Symptom

You have access_token but /verify/validate fails.

Most likely causes

  1. Wrong client_id on validate
  2. Token already used
  3. Forwarded wrong field name / truncated token

How to diagnose

  • Inspect valid:false error code.
  • Ensure single validate.

How to fix

  • Fix client_id.
  • New login if already_used.

Related errors: invalid_verification_token, verification_token_already_used, invalid_client

Related SDK: validateVerification()

Related API: POST /verify/validate

Related guides: Server validation