Linear OAuth: token endpoint returns 503, then 400 invalid_grant on every retry

Question

I am building Linear OAuth and the token endpoint is behaving strangely. The first POST to `https://api.linear.app/oauth/token` with `grant_type=authorization_code` returns `503 Service Unavailable`. Every request after that returns `400 Bad Request` with `{"error": "invalid_grant", "error_description": "Invalid grant: authorization code is invalid"}`. My client_id, client_secret, redirect_uri, and code are all correct. Am I rate-limited, or is something else going on?

issueatlas · Answer

You are not rate-limited, and your code was valid. The culprit was the timeSchedule:write scope in the authorize URL. Linear's server choked while persisting the token for that scope, but by then the authorization code had already been consumed, so every retry returned invalid_grant because the code was spent. That is why you see the weird 503-then-400 pattern: the first request fails after consuming the code, and all subsequent requests fail because the code is gone. The fix is to drop timeSchedule:write from your scope list (it overlaps with the other scopes you already request anyway) and start a fresh OAuth flow. Linear also fixed this server-side, and the reporter confirmed the token exchange worked after the change.

Source: https://github.com/linear/linear/issues/637

Linear OAuth: token endpoint returns 503, then 400 invalid_grant on every retry

Finding relevant solutions

History & evidence

Original discussion