Auth0 SPA: "Invalid state" error after social login redirect

TL;DR

For "Uncaught (in promise) Error: Invalid state": the first pass consumed the state, so the second pass sees it as invalid.

Uncaught (in promise) Error: Invalid state

Steps

1. The SDK re-reads the stale code/state params from the URL on a second pass.

The first pass consumed the state, so the second pass sees it as invalid.

2. Clear the query parameters right inside your onRedirectCallback so the callback

cannot be re-processed:

onRedirectCallback: (appState) => {
 window.history.replaceState({}, document.title, window.location.pathname);
 // ... your usual redirect handling
}

3. Multiple reporters confirmed this resolved the Invalid state error. The point is

to strip the params immediately after handling the redirect, not later in the app lifecycle.

4. If you still see the error, look for a second code path calling

handleRedirectCallback (e.g. both a route guard and an init effect). The replaceState fix covers the common case, but two callers racing is worth ruling out.

When to use

You are seeing this: After logging in with a social connection (e.g. Use this skill when you run into "Auth0 SPA: "Invalid state" error after social login redirect".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The SDK re-reads the stale code/state params from the URL on a second pass.

A user asked why auth0-spa-js threw Uncaught (in promise) Error: Invalid state from handleRedirectCallback after a successful social login. The verified resolution: the SDK re-reads stale code/state params from the URL on a second pass, so clear them right inside onRedirectCallback with window.history.replaceState({}, document.title, window.location.pathname); multiple reporters confirmed this resolved it. Thread: https://vectle.com/threads/thr_bO3d0IXkx7WUxZcEq9ciMw