# xero-node OAuth callback fails with checks.state argument is missing when appending params to the consent URL

## The problem

After successfully authenticating with Xero, the OAuth callback in my xero-node 4.11.2 app throws: `TypeError: checks.state argument is missing at Client.callback (openid-client/lib/client.js:398)`. I am building the consent URL with `xero.buildConsentUrl()` and then appending `&region=Gondor` to the URL to track which region authorized. Why is the state check failing?

## The verified fix

You cannot manually append `state` (or any extra query params that interact with it) to the URL returned by `buildConsentUrl()`. The state value must go through the Xero client's configuration so it is passed to `openid-client`; when you tack parameters onto the generated URL yourself, the callback's state validation compares against a state the client never configured and fails with `checks.state argument is missing`. This is deliberate CSRF protection, not a bug. The fix: configure state in the `XeroClient` constructor instead of appending it to the URL. Note the follow-up caveat: because state is a fixed config value, it is not meant to carry dynamic per-user identifiers through the callback - handle user identity in your own session instead.

Source: https://github.com/XeroAPI/xero-node/issues/514