Flow State Not Found

Assessment

This issue has not been assessed yet.

Description

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Google oauth with

 auth.exchangeCodeForSession(code);

Doesn't work 30% of the times, especially for mobile devices.
The exact same implementation works perfectly for twitch

To Reproduce

Go to jaaneek.feedbackvote.com
Try to login with Google(youtube), preferably with mobile chrome browser

Expected behavior

user is logged in

Screenshots

Contributor guide

Open the contributing guide

First steps

1. Read the whole issue, then the project's contributing guide.
2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
3. Fork the repository and make your change on a branch.
4. Open a pull request that references the issue number.

More from supabase/auth

• RefreshTokenGrant leaks raw internal error text to API clients in the msg field Open

  Difficulty 2/5 1-3 hours Newbie friendliness 78/100

  supabase/auth#2812 · Opened Sep 15, 2026

• OAuth 2.1 server: MFA verification deletes OAuth client sessions (InvalidateSessionsWithAALLessThan does not exclude oauth_client_id) Open
  bug

  Difficulty 2/5 1-3 hours Newbie friendliness 84/100

  supabase/auth#2801 · 1 comment · Opened Sep 12, 2026

• `after-user-created` hook fires on every external OAuth sign-in, not just on account creation Open
  bug

  Difficulty 2/5 1-3 hours Newbie friendliness 84/100

  supabase/auth#2726 · 1 comment · Opened Aug 24, 2026

• Audit log entries for identity_unlinked are written with an empty log_type Open

  Difficulty 1/5 Under an hour Newbie friendliness 86/100

  supabase/auth#2679 · Opened Aug 6, 2026

• PUT /user 500s when a customize_access_token hook blanks session_id Open
  bug

  Difficulty 2/5 1-3 hours Newbie friendliness 74/100

  supabase/auth#2665 · 1 comment · Opened Aug 1, 2026

All issues in supabase/auth

Similar issues

• [optimization:agents-md-curator] AGENTS.md: compress duplicated Debugging & Logging section and merge redundant autopilot rules Open
  optimization optimization:agents-md-curator

  Difficulty 2/5 1-3 hours Newbie friendliness 86/100

  githubnext/gh-aw-cao#13143 · Opened Sep 20, 2026

• fix(ui/spend): normalize mnemonic before keystore reattach comparison Open

  Difficulty 2/5 1-3 hours Newbie friendliness 84/100

  blinklabs-io/bursa#904 · Opened Sep 20, 2026

• docs(parser): clarify State callback lifecycle Open

  Difficulty 2/5 1-3 hours Newbie friendliness 84/100

  yanet-platform/ipfw-go#129 · Opened Sep 20, 2026

• [confmap/provider/googlesecretmanagerprovider] Missing URI format validation for Google Secret Manager resource paths Open
  bug confmap/provider/googlesecretmanagerprovider needs triage

  Difficulty 2/5 1-3 hours Newbie friendliness 72/100

  open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments · Opened Sep 20, 2026

• bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Open
  bug

  Difficulty 2/5 1-3 hours Newbie friendliness 90/100

  coder/coder#29623 · 1 comment · Opened Sep 20, 2026

More Go issues