SECURITY WARNING: Never run commands you don't understand. Always review code before execution. Use at your own risk.
FixMyError.net
Auth New Added 28 August 2026

OAuth 2: invalid_grant (PKCE code_verifier does not match)

The code_verifier sent to the token endpoint does not hash to the code_challenge sent to the authorisation endpoint. Usually the verifier was regenerated, lost across a page navigation, or encoded incorrectly.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix
# The verifier must be stored across the redirect and reused exactly.
// Generate once, persist, reuse
const verifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
sessionStorage.setItem('pkce_verifier', verifier);
const challenge = base64url(await crypto.subtle.digest('SHA-256', enc.encode(verifier)));

# Rules that catch most bugs:
# - base64url without padding, not standard base64
# - challenge = BASE64URL(SHA256(ASCII(verifier))): hash the string, not bytes of a hash
# - code_challenge_method must be S256, and match on both requests

How to diagnose Auth errors

Identity errors are almost always configuration mismatches between two systems rather than code bugs: a redirect URI registered with a trailing slash, a client secret that was rotated on one side only, a clock that has drifted past the token skew allowance. Because the identity provider deliberately returns vague errors to avoid leaking information to attackers, the provider's own log is usually far more informative than the message your application receives.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

  1. Open the identity provider's log or event stream first. Auth0, Okta and Keycloak all record a detailed reason that they never send back to the client.
  2. Compare the redirect URI byte for byte, including scheme, port and trailing slash. http://localhost:3000/callback and http://localhost:3000/callback/ are different URIs.
  3. Decode the token rather than guessing. Paste it into a local JWT decoder and check iss, aud, exp and nbf, never a remote paste site, because tokens are credentials.
  4. Check clock skew with timedatectl or ntpq -p. Kerberos, SAML and JWT all reject tokens outside a tight time window, and a drifting VM clock produces intermittent, unreproducible auth failures.
  5. For passkeys and WebAuthn, verify the Relying Party ID matches the origin exactly and that the page is served over HTTPS or on localhost. Nothing else is a secure context.

Tools worth reaching for

  • Provider audit logs
  • jwt decoding (locally)
  • openssl x509 -noout -text
  • browser devtools network tab

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

datatracker.ietf.org

Related Auth errors

See all 11 Auth errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.