xint-pkce-state-must-match-same-invocation

Each xint auth setup invocation generates a fresh PKCE code_verifier and state parameter. If you run auth setup twice (e.g., to fix a URL issue), the authorization code from the first URL is invalid for the second invocation’s state. Always use the auth URL and paste the redirect code in a single uninterrupted flow.