Spotify Oauth not working: InvalidCheck: pkceCodeVerifier

Environment

 System:
    OS: Windows 11 10.0.26100
    CPU: (16) x64 AMD Ryzen 7 5825U with Radeon Graphics
    Memory: 18.29 GB / 31.31 GB
  Binaries:
    Node: 22.8.0 - C:\Program Files\nodejs\node.EXE
    npm: 10.9.2 - C:\Program Files\nodejs\npm.CMD
    pnpm: 10.11.0 - ~\AppData\Roaming\npm\pnpm.CMD
  Browsers:
    Edge: Chromium (119.0.2151.93)
    Internet Explorer: 11.0.26100.1882
  npmPackages:
    @auth/unstorage-adapter: ^2.0.0 => 2.10.0 
    next: latest => 15.3.4 
    next-auth: beta => 5.0.0-beta.29 
    react: ^18.2.0 => 18.3.1

Reproduction URL

https://github.com/Trebossalol/next-auth-example

Describe the issue

Note: Spotify Callback URI changes

Since April 2025 Spotify changed the policies of the callback URI. It must not use localhost but 127.0.0.1.

See here

When signing in with Spotify, after completing the Spotify authorization and beeing redirected back to my apps callback URL, I get the following error on the server:

[auth][error] InvalidCheck: pkceCodeVerifier value could not be parsed. Read more at https://errors.authjs.dev#invalidcheck

During testing, I also set NEXTAUTH_URL to http://127.0.0.1:3000; This resulted in the following error during callback phase:

[auth][error] MissingCSRF: CSRF token was missing during an action signin. Read more at https://errors.authjs.dev#missingcsrf

Ref:
https://github.com/nextauthjs/next-auth/issues/13017#issue-3096413720

How to reproduce

1. Clone the repo and install dependencies pnpm i
2. Copy the .env.local.example and rename the copy to .env.local
3. Add an AUTH_SECRET, AUTH_SPOTIFY_ID and AUTH_SPOTIFY_SECRET env
4. Start the dev server: pnpm dev and try to sign in using Spotify
5. On the authorization page, grant the access

Expected behavior

I expect to be redirected to my callbak URI and have been signed in using Spotify.

Start by reproducing the failure in the linked next-auth-example with the listed environment variables and pnpm commands. Trace the Spotify authorization callback, comparing localhost with 127.0.0.1 while following the reported pkceCodeVerifier and MissingCSRF errors. Done means the callback completes and the user is signed in successfully with Spotify.