ERROR: 'Invalid grant: code verifier is invalid' for Linear custom provider

[exurban]

I'm trying to create a custom provider for linear.app. I'm getting an error of Invalid grant: code verifier is invalid but I think it's more likely related to a problem with my custom provider configuration.

error {
  error: 'invalid_grant',
  error_description: 'Invalid grant: code verifier is invalid'
}
[auth][debug]: callback route error details {
  "method": "GET",
  "query": {
    "code": "0ad68e17416282b50d6cf7660742d862dc8a5f95a681c455ec22d06f411c6b63",
    "state": "eyJyYW5kb20iOiI3OFJNMEZrbVVhckEyR01fX010c1J0azRxTjNES0VWWWZfUEE0YjNwNGE0In0"
  }

Linear is sending a GET request to http://localhost:3000/api/auth/callback/linear?code=...state=...
My understanding is that NextAuth should exchange that code for a token, but the callback function is failing here before it gets a chance to do so.

My configuration is:

{
      id: "linear",
      name: "Linear",
      type: "oauth",
      checks: ["state"],
      wellKnown: "https://client-api.linear.app/.well-known/openid-configuration",
      idToken: true,
      authorization: {
        url: "https://linear.app/oauth/authorize",
        params: {
          response_type: "code",
          scope: "read,write",
          
        },
      },
      token: {
        url: "https://api.linear.app/oauth/token",
        method: "post",
        params: {
          grant_type: "authorization_code",
        },
      },
      issuer: "https://client-api.linear.app",
    },

Documentation for Linear OAuth is at: https://developers.linear.app/docs/oauth/authentication

I'm using

"@auth/core": "^0.18.4",
    "next": "14.0.3",
    "next-auth": "5.0.0-beta.4",
    "react": "^18",
    "react-dom": "^18"

[exurban]

This provider configuration works in next-auth v4, but results in the error above in v5.

error {
error: 'invalid_grant',
error_description: 'Invalid grant: code verifier is invalid'
}

[aakash14goplani]

@exurban - were you able to find solution?

[zdavis]

Having exactly the same problem. @exurban any chance you can share a solution?

[arjunpredev]

It looks like their https://api.linear.app/oauth/token is broken.

[zdavis]

I don't think that's the case. Sending a curl request the oauth code to that endpoint returns a json string with the token as expected. I believe the problem is with Auth.js

[wyattades]

For me the fix was update the checks field to ["state"]

{
  // defaults to: ["pkce"]
  "checks": ["state"],
}

I have no idea if this is still secure though :)