Go to developer

Troubleshoot PKCE

Verifier loss, regeneration mistakes, and Web async vs server sync helpers.

On this page

Web SDK generatePkce() is async. TypeScript/Java server helpers are synchronous. One verifier per login.

PKCE validation fails

Symptom

Token exchange returns invalid_grant related to PKCE.

Most likely causes

  1. Verifier regenerated before exchange
  2. Verifier lost across redirect
  3. Wrong challenge method / mismatch
  4. Confused Web async vs server sync helpers

How to diagnose

  • Web SDK: await generatePkce()
  • Server SDK: generatePkce() is synchronous
  • Persist verifier with state across redirect

How to fix

  • Do not call generatePkce again before exchange.
  • Use SDK redirect helpers that store transient state.

Related errors: invalid_grant, invalid_state

Related SDK: generatePkce(), generatePkce(), handleRedirectCallback()

Related API: POST /oauth/token

Related guides: PKCE