Authorization failed: missing code.
',\n );\n return;\n }\n\n if (!state) {\n res\n .status(400)\n .send(\n 'Authorization failed: missing state parameter.
',\n );\n return;\n }\n\n try {\n const session = await enableBankingService.createSession(code);\n debug(","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/actualbudget/actual/blob/d4334cb6e6123f4d3bcea1ad6166608884c7e658/packages/sync-server/src/app-enablebanking/app-enablebanking.ts#L89-L125","documentation":"The Enable Banking OAuth callback endpoint requires the authorization server to append a `code` query parameter to the redirect URL. When the callback request arrives without it, the handler immediately returns HTTP 400 with this HTML page instead of exchanging the code for tokens. It signals that the OAuth redirect never carried an authorization code, so the flow cannot continue.","triggerScenarios":"The bank/ASPSP redirected the user to /enablebanking-handler (callback) without a `code` query parameter — e.g. the user hit the callback URL directly, the authorization request was malformed, or the provider errored before issuing a code.","commonSituations":"Developers bookmarking or re-opening the callback URL manually; misconfigured redirect URIs where the provider strips query params; Enable Banking authorization failing at the provider side and redirecting back with only an error parameter; proxies rewriting the URL and dropping the query string.","solutions":["Restart the OAuth flow from the beginning (initiate a new authorization request) instead of reusing/reloading the callback URL","Verify the authorization request URL and redirect_uri registered with Enable Banking match exactly, so the provider returns a code","Check whether the provider redirected with an `error` query param and surface that to the user","Inspect any reverse proxy / URL rewriting in front of the sync-server that could strip query parameters"],"exampleFix":"// before (reloading stale callback URL)\nGET https://server/enablebanking-handler -> 400 missing code\n// after (restart flow)\nGET https://server/enablebanking-handler/init → redirect to bank → callback includes ?code=...&state=...","handlingStrategy":"validation","validationCode":"const url = new URL(callbackUrl);\nif (!url.searchParams.get('code')) {\n throw new Error('callback URL has no code param; restart the OAuth flow');\n}","typeGuard":"function hasCode(q: Record