HubSpot OAuth Provider: "State cookie was missing" error on first callback, requires double sign-in on Vercel

Environment

  System:
    OS: Windows 11 10.0.26100
    CPU: (12) x64 Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz
    Memory: 2.68 GB / 11.88 GB
  Binaries:
    Node: 22.17.0 - C:\Program Files\nodejs\node.EXE
    npm: 10.9.2 - C:\Program Files\nodejs\npm.CMD
  Browsers:
    Edge: Chromium (138.0.3351.55)
  npmPackages:
    next: 14.2.4 => 14.2.4
    next-auth: ^4.24.7 => 4.24.11
    react: ^18 => 18.3.1

Reproduction URL

https://github.com/enlguy/next-auth-test

Describe the issue

When using the HubSpot OAuth provider in a standard Next.js 14 App Router application deployed on Vercel, the initial sign-in attempt fails.

After the user authorizes the application on HubSpot, they are redirected back to the application's sign-in page instead of being logged in. The Vercel Runtime Logs show the error [next-auth][error][OAUTH_CALLBACK_ERROR] State cookie was missing.

If the user immediately clicks the "Sign In with HubSpot" button a second time, the authentication flow completes successfully.

This issue persists despite extensive troubleshooting, including:

Verifying all environment variables (NEXTAUTH_URL, NEXTAUTH_SECRET, database URL).

Ensuring the Vercel project's Framework Preset is correctly set to "Next.js".

Confirming a canonical www domain redirect is in place.

Explicitly setting useSecureCookies: true in authOptions.

Manually configuring cookie policies (domain, sameSite, secure) in authOptions.

The bug is fully reproducible in the minimal test project linked below, proving it is not an issue with other application code or dependencies.

Live version at https://next-auth-test-neon.vercel.app/

How to reproduce

Navigate to the live deployment URL provided above.

Click the "Sign In with HubSpot" button.

On the HubSpot authorization screen, approve the connection.

Bug: Observe that you are redirected back to the application's sign-in page, and you are not logged in.

Click the "Sign In with HubSpot" button a second time.

Observe that the sign-in flow now completes successfully, and you are logged in.

Expected behavior

After a user authorizes the application on HubSpot, they should be redirected back to the application and be in a fully signed-in state on the very first attempt.

Start by reproducing the first-callback failure in the linked minimal test project and live Vercel deployment, using the HubSpot sign-in flow described above. Trace the OAuth callback and state-cookie handling in the NextAuth configuration; done means the first authorization attempt completes successfully without the "State cookie was missing" error.