[Beeper Desktop] OAuth PKCE authentication fails with invalid_request

Extension

https://www.raycast.com/automattic/beeper

Raycast Version

1.104.18

OS Version

macOS 15.7.3 (24G419)

Description

The Beeper Desktop extension's OAuth (PKCE) flow is broken. When a user attempts to sign in, the browser opens the local Beeper authorize endpoint but immediately redirects back to https://raycast.com/redirect... with error=invalid_request, without ever showing the approval/consent screen in Beeper Desktop.

This happens consistently with:

• The magic client_id=raycast-beeper-extension
• Dynamically registered clients (via POST /oauth/register)

Multiple redirect URI variations were tested, including:

• https://raycast.com/redirect?packageName=Extension
• https://raycast.com/redirect/extension

All result in the same immediate invalid_request error.

• Beeper Desktop version: 4.2.860
• Dynamic client registration (/oauth/register) succeeds and returns a valid client_id, but the subsequent /oauth/authorize call is still rejected by Beeper.
• The root cause appears to be on Beeper’s side (strict validation or allow-list issues for Raycast’s Web redirect method).

Recommendation :

• A manualToken preference was implemented in the extension as a necessary workaround so users are not blocked.

Steps To Reproduce

1. Install the Beeper Desktop extension.
2. Run any command requiring authentication (e.g. "Recent Chats").
3. The extension initiates OAuth using Raycast's OAuth.PKCEClient with Web redirect.
4. The browser opens an authorize URL against http://localhost:23373/oauth/authorize.
5. Beeper immediately returns error=invalid_request in the redirect back to Raycast.
6. No approval screen is shown in Beeper Desktop.
7. The extension remains unauthenticated.

Current Behaviour

• OAuth PKCE flow fails immediately with error=invalid_request.
• Users never reach Beeper’s consent/approval UI.
• The only reliable way to authenticate is by manually creating a token in Beeper Desktop and pasting it into the extension preferences.
• Partial successes in the past have created multiple duplicate "Raycast Beeper Extension" entries under Approved Connections.

Expected Behaviour

The OAuth flow should successfully reach Beeper Desktop’s approval screen (or complete the PKCE handshake without an immediate invalid_request), allowing users to authenticate the extension normally.

Start with the Beeper Desktop extension's OAuth.PKCEClient Web redirect flow and reproduce the request to the local /oauth/authorize endpoint after registering a client with /oauth/register. Compare the redirect URI and client parameters against the reported invalid_request response; done means the flow reaches Beeper's approval screen and completes the PKCE handshake without requiring manualToken.