X_OAUTH_STATE_INVALID
Means
state, nonce or PKCE verifier did not match
Typical cause
a replayed callback URL, a handshake that expired, or a token minted for another browser
Fix
restart the flow at GET /auth/sso/<provider> — a callback URL is single-use