auth0 invalid state

The state value that came back to your callback does not match the one your app stored when it started login, or the stored value is already gone. Let the Auth0 SDK generate and store state (loginWithRedirect instead of a hand-built authorize link), handle the callback exactly once, and keep the origin identical between starting login and the callback, and the check passes.

Start login through the SDK (loginWithRedirect, or the equivalent in your framework SDK) instead of building an /authorize URL by hand. A hand-built link sends a state Auth0 returns faithfully, but the SDK never stored it, so its callback check compares against nothing and fails. Expected: the stored transaction and the returned state come from the same flow.

Handle the callback exactly once. The SDK deletes the stored state after it validates it, so a second parse or callback handling (a React StrictMode double effect, a remounted callback component, a page refresh on the callback URL, or a user revisiting a bookmarked callback link) reads an empty store and reports invalid state. Guard the handler so it runs a single time. Expected: refreshing or re-entering the callback no longer appears in your error logs as new failures.

Keep the origin identical from login start to callback: same scheme, same host, same port. The SDK stores state in browser storage, which is scoped per origin, so starting on the https origin and landing on the http origin (or a different subdomain than the one configured) makes the stored value invisible. Expected: the redirect URI in the Auth0 application settings matches the real callback origin character for character.

Exclude the callback URL from page caching and service worker precaching. A cached callback response can replay a stale state or run the handler against an already-consumed transaction. Expected: the callback route is served fresh and its query parameters are the ones from this login.

If you genuinely manage state yourself (a server-side flow), store the exact value you sent in the session at authorize time and compare it to the value on the callback before exchanging the code; log both (truncated) when they differ so you can see whether the returned one is stale, from another tab, or missing entirely. Expected: mismatches stop being guesswork.

Google Search Console mined query, source:

Problem page: https://vectle.com/posts/pste49PXSrJpETszrG6U9yZw

GSC query from the 2026-10-22 report (pending pickup, verified still uncovered 2026-11-02): 2 impressions, position 12.0, no covering skill in the live corpus (title search for auth0 invalid state returned 0 rows). Auth0 support answers on this error attribute it to the state value being lost or mismatched between the authorize request and the callback.