[Bug]: Error flow_state_not_found In Google OAuth

[Shabinder]

General Info

• [X] I checked for similar bug report
• [X] I am using the latest version
• [X] I checked the troubleshooting page for similar problems

Version(s)

3.0.1

Kotlin Target(s) and their respective versions

JVM 17

What happened? (include your code)

message=Auth API error: flow_state_not_found, cause=io.github.jan.supabase.auth.exception.AuthRestException: invalid flow state, no valid flow state found

Google Oauth is failing for some users, this is not reproducible at my end. I am deeplinking the user back to the app and then import session from that.

I use

• PKCE Flow

• SelfHosted Instance

  The same exact flow is working for most of my users.

  Code Snippet:

  override suspend fun importSessionFromCode(code: String): Either<AuthError, UserSession> {
  return catchAllOnIO {
    auth.exchangeCodeForSession(code)
    auth.currentSessionOrNull() ?: throw Exception("No session available.")
  }
  }

  Retaled maybe ? https://github.com/supabase/auth/issues/1341

Steps To Reproduce (optional)

No response

Relevant log output (optional)

No response

[jan-tennert]

Just to confirm, you are not using supabase.handleDeeplinks()?

[Shabinder]

No, I don't think that is a common sourceSet API, However the code I am using is inspired from that only.

[jan-tennert]

Yea, I'm just asking because supabase.handleDeeplinks() also calls exchangeCodeForSession which could interfere. No idea though, never seen that error, probably related to https://github.com/supabase/auth/issues/1341. Maybe a (self-hosted) issue occurring on some browsers (=hardly reproducable)?

[Shabinder]

It is very rare but consistent for those facing this. Finding steps to this will be a pain. :(

[jan-tennert]

Did you take a look at this discussion https://github.com/orgs/supabase/discussions/16743? Specifically this comment. But I think you can get more help creating an issue in supabase/auth or in supabase discussions

[Shabinder]

I did, the supabase hosted configuration is I believe mostly correct, since for majority of users, including me, the oAuth is working flawlessly, but only a few rare users are facing this, which makes this much more harder to diagnose...