# X_OAUTH_DENIED

## Means

the user or the provider declined the authorization

## Typical cause

`error=` on the callback redirect — nearly always the consent screen's Cancel. Split out of `X_OAUTH_EXCHANGE_FAILED` so the commonest non-success outcome of a login stops paging on-call as a 502 provider outage

## Fix

restart at `GET /auth/sso/<provider>` and approve the consent screen; nothing is wrong with the app

[Auth and sessions](/error-codes#auth-and-sessions)