# X_OAUTH_STATE_INVALID

## Means

state, nonce or PKCE verifier did not match

## Typical cause

a replayed callback URL, a handshake that expired, or a token minted for another browser

## Fix

restart the flow at `GET /auth/sso/<provider>` — a callback URL is single-use

[Auth and sessions](/error-codes#auth-and-sessions)