Errors

At the authorization request

Error	Cause	What to do
invalid_redirect_uri	the redirect URI does not match the registered one character for character	check scheme, port, path and trailing slash
invalid_client	unknown client_id, or the client is suspended	check the identifier and the client's state in the console
invalid_request	a required parameter is missing — usually code_challenge	enable PKCE
not_in_organization	the application is restricted to an organization's members	the user needs an address in its domain, or to join

A redirect URI error is not returned to your site; it is shown on our page. Otherwise we would be sending data to an unverified address — exactly what the check exists to prevent.

At code exchange

Error	Cause
invalid_grant	the code expired (10 minutes), was already exchanged, or belongs to another client
invalid_client	wrong secret
invalid_request	code_verifier was not sent

Re-exchanging a code is never supported: an honest client has no reason to exchange one code twice, and a dishonest one does.

At refresh

Error	Cause
invalid_grant	the token chain was revoked, the session ended, or the user blocked your site

The response is always the same: send the user to sign in again. If their auth.my session is alive they come straight back without noticing.

On the library side

Message	Cause
unsupported algorithm	the library was configured by hand for a different algorithm; remove the setting and let it read discovery
id_token issuer mismatch	the configured issuer has a trailing slash or different case; it is exactly https://auth.my
state mismatch	your application did not keep state between requests — typical with several instances and no shared session store
origin not allowed	a browser request from an origin that is not among the redirect URIs

None of the above

Send us the client_id, the time of the request to the minute, and the exact error text. Those show what happened on our side; without them, nothing does.