X_OAUTH_EXCHANGE_FAILED
Means
the provider refused the exchange or returned no usable identity
Typical cause
wrong client secret, an unregistered redirect_uri, a spent code, or a missing scope. Also a discovery document that declares a different issuer than the one asked for, and a key set with no importable key (the cached keys are kept). Not the user pressing Cancel — that is X_OAUTH_DENIED
Fix
meta.stage is token or userinfo: for token, match <PROVIDER>_CLIENT_SECRET and the registered redirect_uri, then x doctor --json; for userinfo, restart at GET /auth/sso/<provider>