xint-oauth-pkce-state-per-invocation-manual-exchange-procedure
xint generates a new PKCE state and code_challenge on every auth URL invocation. A redirect code from one flow cannot be exchanged in a different invocation (state mismatch error). Save the PKCE verifier before generating the auth URL, then exchange manually via curl: curl -X POST https://api.x.com/2/oauth2/token with verifier, code, client_id, redirect_uri, and grant_type=authorization_code.
Related
- xint-oauth-pkce-state-mismatch-on-reuse
- xint-pkce-state-must-match-same-invocation
- xint-oauth-pkce-callback-server-binds-to-port-3333-not-8477
- notebooklm-migrated-cookies-rejected-different-http-fingerpr
- gws-oauth-token-expiry-testing-vs-production-consent-screen
- xint-oauth-pkce-single-flow-no-regeneration
- xint-oauth-pkce-state-mismatch-each-invocation-generates-new