Troubleshooting

Step by step: sign-in that never comes back, codes that will not swap, userinfo refusing tokens, and webhooks that do not arrive.

Inicie sesión para ver su propio ID de cliente de prueba en los ejemplos.

Work down each list until one step fixes it. If none does, ask in the chat with the error code and the time it happened.

The person never comes back to my app

1. Does our page show an error instead of signing them in? An unknown client, an unregistered redirect address or a repeated parameter is shown there and never sent back. Check the redirect address matches one you registered exactly, scheme, host, port and path.
2. Is it the test client? Only your team and testers who accepted your invitation can sign in. Check the Testers page: an invitation still waiting does not count.
3. Is it the live client? It signs in nobody until the review is approved.
4. Did you send prompt=none? Then a missing sign-in or consent comes back as an error, not a page.

The code will not swap (invalid_grant)

1. Swap it within 60 seconds, and only once. A retry after a timeout fails because the first attempt used it.
2. Send the same redirect_uri the authorize request had.
3. Send the code_verifier whose challenge you sent, from the same browser's cookie.
4. Make sure you swap with the client the code was issued to: test codes on the test client.

invalid_client at the token endpoint

1. Is the secret the current one, and not expired? Check Credentials.
2. A public app sends no secret at all.
3. With private_key_jwt: aud is the token endpoint, exp at most ten minutes ahead, and each jti new.

Userinfo answers invalid_token

1. Send the access token, not the ID token.
2. Access tokens last 15 minutes: refresh, or sign them in again.
3. The person may have taken back access. You will have had consent.revoked.

Webhooks do not arrive

1. Is the address public and https? We never deliver to private or loopback addresses, and never follow redirects.
2. Do you answer 2xx within ten seconds? Slow handlers should queue the work and answer at once.
3. Press Send a test and read the attempt's status on the Webhooks page.
4. Check the signature against the raw body. A parsed and re-serialised body never matches.

429 rate_limited

Wait the Retry-After seconds. Requests over the limit still count, so a tight retry loop keeps you over it. Your limits are on the app's API keys page.