X_OAUTH_TOKEN_INVALID
Means
the id token failed its signature, issuer, audience or expiry check
Typical cause
As of 2026-08 the signature is verified too, against the issuer's published key set through a JWKS client — until this cycle the token was decoded and its claims read, so a token minted by whoever posted it to the callback passed every check it faced. Also: a token that is not a three-segment JWT, a payload with no iss/sub/exp/aud, a client id in .env that is not the one the authorize URL was built with, or a skewed host clock
Fix
the fix branches on which check failed — for a signature, confirm the token came from the provider's token URL and was not minted by the caller; for the rest, match <PROVIDER>_CLIENT_ID to the id beginOAuth() used, then restart at GET /auth/sso/<provider>