{"record":{"id":"851165d836cfc7b9","repo":"eyaltoledano/claude-task-master","slug":"pkce-init-failed","errorCode":"PKCE_INIT_FAILED","errorMessage":"Failed to initiate PKCE flow: ${error.message}","messagePattern":"Failed to initiate PKCE flow: (.+?)","errorType":"error_code","errorClass":"AuthenticationError","httpStatus":null,"severity":"error","filePath":"packages/tm-core/src/modules/integration/clients/supabase-client.ts","lineNumber":150,"sourceCode":"\t * Sign in with PKCE flow (for CLI auth)\n\t */\n\tasync signInWithPKCE(): Promise<{ url: string; codeVerifier: string }> {\n\t\tconst client = this.getClient();\n\n\t\ttry {\n\t\t\t// Generate PKCE challenge\n\t\t\tconst { data, error } = await client.auth.signInWithOAuth({\n\t\t\t\tprovider: 'github',\n\t\t\t\toptions: {\n\t\t\t\t\tredirectTo:\n\t\t\t\t\t\tprocess.env.TM_AUTH_CALLBACK_URL ||\n\t\t\t\t\t\t'http://localhost:3421/auth/callback',\n\t\t\t\t\tscopes: 'email'\n\t\t\t\t}\n\t\t\t});\n\n\t\t\tif (error) {\n\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t`Failed to initiate PKCE flow: ${error.message}`,\n\t\t\t\t\t'PKCE_INIT_FAILED'\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tif (!data?.url) {\n\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t'No authorization URL returned',\n\t\t\t\t\t'INVALID_RESPONSE'\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Extract code_verifier from the URL or generate it\n\t\t\t// Note: Supabase handles PKCE internally, we just need to handle the callback\n\t\t\treturn {\n\t\t\t\turl: data.url,\n\t\t\t\tcodeVerifier: '' // Supabase manages this internally\n\t\t\t};","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/packages/tm-core/src/modules/integration/clients/supabase-client.ts#L132-L168","documentation":"signInWithPKCE throws AuthenticationError with code PKCE_INIT_FAILED when the Supabase auth client's signInWithOAuth call returns an error while initiating the PKCE OAuth flow. The Supabase error message is embedded in the thrown error.","triggerScenarios":"Calling signInWithPKCE() when Supabase rejects the OAuth initiation: invalid provider, misconfigured redirect URL ('http://localhost:3421/auth/callback') not allowlisted in Supabase dashboard, or unreachable/invalid Supabase project.","commonSituations":"Redirect URL not registered in Supabase Auth settings, OAuth provider not enabled in the project, wrong Supabase URL, or network issues reaching the auth endpoint.","solutions":["Read the embedded error.message for the root cause","Register 'http://localhost:3421/auth/callback' in Supabase Dashboard > Auth > URL Configuration > Redirect URLs","Enable/configure the OAuth provider in the Supabase dashboard","Verify TM_SUPABASE_URL points at the correct project"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"try {\n  await client.signInWithPKCE();\n} catch (e) {\n  if (e instanceof AuthenticationError && e.code === 'PKCE_INIT_FAILED') {\n    // check redirect URL registration and provider config in Supabase dashboard\n  }\n}","preventionTips":["Register http://localhost:3421/auth/callback in Supabase redirect URLs before local dev","Enable the OAuth provider in the Supabase project","Verify env-provided Supabase URL with a health check at startup"],"tags":["auth","oauth","pkce","supabase"],"backgroundTag":"oauth-flow-init-failed","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}