If the authorization page reports that the request is incomplete or invalid, the app developer should inspect the OAuth URL that initiated the flow. Customers should restart from the app rather than editing its parameters manually.
The documented flow uses response_type=code, the client ID, an exact registered redirect URI, space-separated scopes, state, a PKCE code challenge, and code_challenge_method=S256. Duplicate query parameters are rejected by the authorization page.
Use a fresh PKCE verifier and matching challenge for each authorization and retain them with state in the server session. Verify returned state before exchanging the code. The callback must match a registered public HTTPS redirect rather than an arbitrary destination.
If the page instead says the app is unavailable, check the app’s current configuration, review state, and company eligibility. Keep client secrets out of authorization URLs and browser logs. Provide support with the app ID and safe error wording rather than a complete callback containing a short-lived authorization code.
Was this article helpful?
Tell us whether this answered the question you came with.