Invalid state parameter. It looks like the authorization flo

Error message

Invalid state parameter. It looks like the authorization flow was not initiated by the app.

What it means

Error "Invalid state parameter. It looks like the authorization flow was not initiated by the app." thrown in Kong/insomnia.

Source

Thrown at packages/insomnia/src/sync/git/providers/github.ts:297

        authUrl: url.toString(),
        state,
      };
    } catch (error) {
      const errorMessage = error instanceof Error ? error.message : String(error);
      console.error('Failed to initiate the GitHub OAuth flow:', error);
      throw new Error(`Failed to initiate the GitHub OAuth flow: ${errorMessage}`);
    }
  }

  /**
   * Complete OAuth flow
   * Exchanges code for token and creates/updates credential in database
   */
  async completeOAuth(code: string, state: string): Promise<OAuthCompleteResult> {
    try {
      // Validate state for security (CSRF protection)
      if (!PLAYWRIGHT_TEST && !githubStatesCache.has(state)) {
        throw new Error('Invalid state parameter. It looks like the authorization flow was not initiated by the app.');
      }
      const reauthorizingCredentialId = githubStatesCache.get(state);

      // Exchange code for access token via Insomnia backend
      const response = await net.fetch(getApiBaseURL() + '/v1/oauth/github-app', {
        method: 'POST',
        body: JSON.stringify({
          code,
        }),
        headers: {
          'Content-Type': 'application/json',
        },
      });

      if (!response.ok) {
        throw new Error(`Failed to exchange code for token: ${response.statusText}`);
      }

View on GitHub (pinned to d9bb2b0142)

When it happens

Trigger: Thrown at packages/insomnia/src/sync/git/providers/github.ts:297 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/923a7e3cbb0a08fb. Report an issue: GitHub.