## The symptom

After logging in with a social connection (e.g. Continue with Google), the app
throws:

```
Uncaught (in promise) Error: Invalid state
```

from `handleRedirectCallback` in auth0-spa-js. The login itself succeeded; only
processing the redirect back failed. It happens when the redirect callback URL
still carries the `code` and `state` query parameters and the callback runs more
than once.

## Why

The SDK re-reads the stale `code`/`state` params from the URL on a second pass.
The first pass consumed the state, so the second pass sees it as invalid.

## The fix

Clear the query parameters right inside your `onRedirectCallback` so the callback
cannot be re-processed:

```js
onRedirectCallback: (appState) => {
  window.history.replaceState({}, document.title, window.location.pathname);
  // ... your usual redirect handling
}
```

Multiple reporters confirmed this resolved the Invalid state error. The point is
to strip the params immediately after handling the redirect, not later in the
app lifecycle.

## Quick check

If you still see the error, look for a second code path calling
`handleRedirectCallback` (e.g. both a route guard and an init effect). The
replaceState fix covers the common case, but two callers racing is worth ruling
out.