PKCE verification failed Authentication Origin: Application & API Last updated 14 Oct 2026

OAuth PKCE error: invalid_grant — PKCE verification failed / code_verifier does not match code_challenge / code_challenge required

The code_verifier sent to the token endpoint doesn’t match the code_challenge from the authorize request, or PKCE is required but wasn’t sent.

Exact message you may see PKCE verification failedcode_verifier does not match code_challengeMissing code_challengeinvalid code verifiercode_challenge required
Explore the map of this error Full error map →
Seen on: REST API

Meaning

The verifier must be stored between redirect and callback (sessionStorage/cookie) and hashed with SHA-256, base64url-encoded without padding. Losing it across tabs/redirects, using plain vs S256 inconsistently, or encoding mistakes break PKCE.

Common causes

  • Verifier lost between authorize and callback (new tab, storage cleared)
  • Wrong hashing/encoding (base64 instead of base64url, padding)
  • Challenge method mismatch (plain vs S256)
  • Public client without PKCE where required

⚡ Quick fix

  1. Persist the verifier and reuse the exact same string
  2. Use a library for PKCE generation
  3. Send code_challenge_method=S256

Detailed fix by platform

JavaScript

  1. javascript
    const verifier = base64url(crypto.getRandomValues(new Uint8Array(32)));
const challenge = base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
sessionStorage.setItem("pkce_verifier", verifier);

How to diagnose

  1. Storage — Verifier available at callback?
  2. Encoding — base64url, no padding
  3. Method — S256 on both sides

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

auth/popup-closed-by-user — Firebase Auth: auth/popup-closed-by-user / auth/popup-blocked / auth/cancelled-popup-request (Authentication)auth/popup-closed-by-…auth/unauthorized-domain — Firebase Auth: auth/unauthorized-domain — This domain is not authorized for OAuth operations for your Firebase project (Authentication)auth/unauthorized-dom…bad_verification_code — GitHub OAuth: {"error":"bad_verification_code","error_description":"The code passed is incorrect or expired."} (Authentication)bad_verification_codedeleted_client — Google OAuth: Error 401: deleted_client — The OAuth client was deleted (Authentication)deleted_clientinvalid_grant — OAuth 2.0 Error: invalid_grant (Authentication)invalid_grantinvalid_request — OAuth 2.0 Error: invalid_request (missing or invalid parameter) (Authentication)invalid_requeststate mismatch — OAuth callback error: state mismatch / Unable to verify authorization request state / State cookie was missing (Authentication)state mismatchunsupported_response_type — OAuth 2.0 Error: unsupported_response_type (Authentication)unsupported_response_…PKCE veri…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.