X_AUTH_CONSENT_INVALID
Means
a consent was approved for a request the authorization server refuses
Typical cause
approve() or deny() was handed a request readRequest(url) would refuse — an unknown client, an unregistered redirect, a scope the client never asked for
Fix
server.readRequest(url) # on the consent page: render its refusal, approve only what it returned