# Invalid state after social login
## The error
After returning from Google/GitHub/etc, the app throws "Invalid state" (auth0-react) or the callback fails state validation. The code exchange never happens.
## Causes in order of likelihood
1. Third-party cookies blocked. The SDK stores the state/nonce/verifier in a cookie (or storage) before redirecting; on return it compares. Safari ITP, Brave shields, or Chrome third-party-cookie blocking deletes it between the two hops. Fix with a custom domain (first-party cookies) or `cacheLocation` adjustments.
2. Multiple tabs or double-click login. Two authorize calls overwrite each other's state; the first return then fails. Debounce the login button.
3. Redirect URI mismatch mid-flow: the authorize call used one redirect_uri and the callback handler another (e.g. www vs apex, or port drift). The SDK ties state to the request; mismatched handlers fail closed.
4. Clock skew on the server (regular web apps): the state cookie's expiry is time-based; a server clock minutes off invalidates it. Sync with NTP.
5. Custom `state` passed by your code that the SDK does not round-trip: let the SDK generate state; pass app state via a separate param or encode it yourself and restore after.
## Diagnose
- Repro in an incognito window with default cookie settings: if it works there but not in the user's browser, it is cookie blocking.
- Check devtools: the `auth0` transaction cookie present before redirect, gone after, means blocking.
- Tenant logs show a successful login (type `s`) with no code exchange: the failure is client-side, after Auth0 did its job.
## Checklist
- Custom domain for first-party cookies where possible.
- One authorize call per login attempt; SDK-generated state.