Vectle found the following relevant skills: - AWS "InvalidClientTokenId" in automation: credential chain debugging - exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1"
Fixes OAuth2 PKCE 'code_verifier mismatch' invalid_grant errors. Use when the token exchange fails on PKCE. Key trigger: invalid_grant naming the verifier.
Fixes Dropbox Sign 'invalid_grant' after rotating the app key. Use when OAuth token exchange breaks right after a key rotation. Key trigger: the integration still sends the old secret, or the authorization code expired.
For engineers maintaining an Intercom OAuth integration. Use when token refresh fails with invalid_grant. Key triggers: refresh token expired, revoked, or already used by a concurrent refresh. Not for authorize-step failures or invalid_client errors.
For engineers maintaining a Zendesk OAuth integration. Use when token refresh fails with invalid_grant because the refresh token was revoked. Key triggers: user revoked access, admin uninstalled the app, password change. Not for transient network errors or expired access tokens.
For engineers integrating HubSpot OAuth into onboarding. Use when API calls fail because the granted token lacks a required scope such as crm.objects.contacts.write. Key triggers: scope missing from authorize URL, scope added to app but user never re-authorized. Not for expired tokens or invalid API keys.
For engineers handling Slack app installs in an onboarding flow. Use when the OAuth callback returns error=access_denied. Key triggers: user clicked Deny, workspace admin restrictions, consent fatigue. Not for invalid-code, redirect-mismatch, or scope errors.
For engineers wiring Salesforce OAuth into an onboarding flow. Use when the authorize or token call fails with invalid_client_id. Key triggers: wrong consumer key, wrong org (production vs sandbox), OAuth disabled on the connected app, callback URL mismatch. Not for invalid_grant or expired-code errors.
Fixes Okta authorization-code exchanges that fail because the requested scope is invalid or not granted to the app. Use when the Okta token exchange rejects the scope list. Not for expired authorization codes, not for redirect_uri mismatches, not for other providers' scope errors.
Vectle found the following relevant skills: - Supabase OAuth redirect_uri_mismatch: the provider console and Supabase disagree - microsoft graph oauth aaddsts50011 redirect uri mismatch error
Vectle found the following relevant skills: - AWS "InvalidClientTokenId" in automation: credential chain debugging - exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1"
Vectle found the following relevant skills: - oauth2: "invalid_grant" "Malformed auth code." - okta oauth "invalid_grant: the authorization code has expired" - [Box oauth2…
Vectle found the following relevant skills: - google.auth.exceptions.RefreshError: invalid_grant: Token has been expired or revoked - Xero invalid_grant about a week after connecting: refresh token rotation not persisted
Fixes Keycloak token exchanges that fail with invalid_code right after the redirect. Use when the authorization code is rejected at the token endpoint. Not for expired sessions, not for client authentication failures, not for non-Keycloak providers.
Vectle found the following relevant skills: - Auth0 SPA: "Invalid state" error after social login redirect - Failed exchange at /oauth/token - code_verifier, redirect_uri, and one-time codes