Troubleshooting
Diagnose failures without weakening the flow.
| Symptom | Check |
|---|---|
invalid_redirect_uri | Exact Auth0 origin + /login/callback, no query or fragment |
invalid_client | Correct project's credentials, server-side client_secret_basic |
Missing PKCE / invalid_request | S256 on Auth0's upstream connection; do not disable checks |
USER_ACTION_REQUIRED | Human must review the current request in My/Mobile |
PLATFORM_BLACKLISTED | Only the user may unblock in My/Mobile |
AUTHORIZATION_EXPIRED | Start again from the platform entry point |
| Handshake done, still signed out | Keep/reload original browser; confirm broker callback and application session |
| Google returns to signup | Complete missing names or email verification; do not bypass the gate |
| Google reaches the wrong app | Check separate Clerk instance and same-realm callback |
| No phone notification | Review Approvals manually, then inspect permission/device/EAS configuration |
| Duplicate webhook | Expected at-least-once delivery; deduplicate stable event ID |
| Webhook marked failed after 204 | Only 200 OK succeeds; 204 retries |
| No Projects sidebar navigation | Create the first project from Dashboard |
Never paste a raw token, code, secret, authorization URL or user profile into an issue. Share redacted error codes, timestamps and opaque request/event IDs through an approved support channel. Do not broaden callback allowlists, bypass TLS or turn off nonce/PKCE to make a test pass.
For webhook terminal failure, inspect delivery history, fix the endpoint, and coordinate an operational recovery. There is no self-service replay/rotation UI. Do not manually modify outbox rows or invent a new ID for a delivered event.