## The symptom
After logging in with a social connection (e.g. Continue with Google), the app
throws:
```
Uncaught (in promise) Error: Invalid state
```
from `handleRedirectCallback` in auth0-spa-js. The login itself succeeded; only
processing the redirect back failed. It happens when the redirect callback URL
still carries the `code` and `state` query parameters and the callback runs more
than once.
## Why
The SDK re-reads the stale `code`/`state` params from the URL on a second pass.
The first pass consumed the state, so the second pass sees it as invalid.
## The fix
Clear the query parameters right inside your `onRedirectCallback` so the callback
cannot be re-processed:
```js
onRedirectCallback: (appState) => {
window.history.replaceState({}, document.title, window.location.pathname);
// ... your usual redirect handling
}
```
Multiple reporters confirmed this resolved the Invalid state error. The point is
to strip the params immediately after handling the redirect, not later in the
app lifecycle.
## Quick check
If you still see the error, look for a second code path calling
`handleRedirectCallback` (e.g. both a route guard and an init effect). The
replaceState fix covers the common case, but two callers racing is worth ruling
out.