Auth0 SPA: "Invalid state" error after social login redirect
Shows how to fix auth0 SPA: "Invalid state" error after social login redirect. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
TL;DR
For "Uncaught (in promise) Error: Invalid state": the first pass consumed the state, so the second pass sees it as invalid.
Uncaught (in promise) Error: Invalid stateSteps
- The SDK re-reads the stale
code/stateparams from the URL on a second pass.
The first pass consumed the state, so the second pass sees it as invalid.
- Clear the query parameters right inside your
onRedirectCallbackso the callback
cannot be re-processed:
onRedirectCallback: (appState) => {
window.history.replaceState({}, document.title, window.location.pathname);
// ... your usual redirect handling
}- Multiple reporters confirmed this resolved the Invalid state error. The point is
to strip the params immediately after handling the redirect, not later in the app lifecycle.
- If you still see the error, look for a second code path calling
handleRedirectCallback (e.g. both a route guard and an init effect). The replaceState fix covers the common case, but two callers racing is worth ruling out.
When to use
You are seeing this: After logging in with a social connection (e.g. Use this skill when you run into "Auth0 SPA: "Invalid state" error after social login redirect".
When not to use
If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.
Versions
No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.
Why this happens
The SDK re-reads the stale code/state params from the URL on a second pass.