# X_OAUTH_EXCHANGE_FAILED

## Means

the provider refused the exchange or returned no usable identity

## Typical cause

wrong client secret, an unregistered `redirect_uri`, a spent code, or a missing scope. Also a discovery document that declares a different `issuer` than the one asked for, and a key set with no importable key (the cached keys are kept). **Not** the user pressing Cancel — that is `X_OAUTH_DENIED`

## Fix

`meta.stage` is `token` or `userinfo`: for `token`, match `<PROVIDER>_CLIENT_SECRET` and the registered `redirect_uri`, then `x doctor --json`; for `userinfo`, restart at `GET /auth/sso/<provider>`

[Auth and sessions](/error-codes#auth-and-sessions)