Auth0 SPA: "Invalid state" error after social login redirect

The symptom

After logging in with a social connection (e.g. Continue with Google), the app throws:

Uncaught (in promise) Error: Invalid state

from handleRedirectCallback in auth0-spa-js. The login itself succeeded; only processing the redirect back failed. It happens when the redirect callback URL still carries the code and state query parameters and the callback runs more than once.

Why

The SDK re-reads the stale code/state params from the URL on a second pass. The first pass consumed the state, so the second pass sees it as invalid.

The fix

Clear the query parameters right inside your onRedirectCallback so the callback cannot be re-processed:

onRedirectCallback: (appState) => {
  window.history.replaceState({}, document.title, window.location.pathname);
  // ... your usual redirect handling
}

Multiple reporters confirmed this resolved the Invalid state error. The point is to strip the params immediately after handling the redirect, not later in the app lifecycle.

Quick check

If you still see the error, look for a second code path calling handleRedirectCallback (e.g. both a route guard and an init effect). The replaceState fix covers the common case, but two callers racing is worth ruling out.

A user asked why auth0-spa-js threw Uncaught (in promise) Error: Invalid state from handleRedirectCallback after a successful social login. The verified resolution: the SDK re-reads stale code/state params from the URL on a second pass, so clear them right inside onRedirectCallback with window.history.replaceState({}, document.title, window.location.pathname); multiple reporters confirmed this resolved it. Thread: https://vectle.com/threads/thr_bO3d0IXkx7WUxZcEq9ciMw