eyaltoledano/claude-task-master · error · AuthenticationError

PKCE_INIT_FAILED

PKCE_INIT_FAILED

Error message

Failed to initiate PKCE flow: ${error.message}

What it means

signInWithPKCE throws AuthenticationError with code PKCE_INIT_FAILED when the Supabase auth client's signInWithOAuth call returns an error while initiating the PKCE OAuth flow. The Supabase error message is embedded in the thrown error.

Source

Thrown at packages/tm-core/src/modules/integration/clients/supabase-client.ts:150

	 * Sign in with PKCE flow (for CLI auth)
	 */
	async signInWithPKCE(): Promise<{ url: string; codeVerifier: string }> {
		const client = this.getClient();

		try {
			// Generate PKCE challenge
			const { data, error } = await client.auth.signInWithOAuth({
				provider: 'github',
				options: {
					redirectTo:
						process.env.TM_AUTH_CALLBACK_URL ||
						'http://localhost:3421/auth/callback',
					scopes: 'email'
				}
			});

			if (error) {
				throw new AuthenticationError(
					`Failed to initiate PKCE flow: ${error.message}`,
					'PKCE_INIT_FAILED'
				);
			}

			if (!data?.url) {
				throw new AuthenticationError(
					'No authorization URL returned',
					'INVALID_RESPONSE'
				);
			}

			// Extract code_verifier from the URL or generate it
			// Note: Supabase handles PKCE internally, we just need to handle the callback
			return {
				url: data.url,
				codeVerifier: '' // Supabase manages this internally
			};

View on GitHub (pinned to c0c98d367c)

Solutions

1. Read the embedded error.message for the root cause
2. Register 'http://localhost:3421/auth/callback' in Supabase Dashboard > Auth > URL Configuration > Redirect URLs
3. Enable/configure the OAuth provider in the Supabase dashboard
4. Verify TM_SUPABASE_URL points at the correct project

Example fix

null

null

null

try {
  await client.signInWithPKCE();
} catch (e) {
  if (e instanceof AuthenticationError && e.code === 'PKCE_INIT_FAILED') {
    // check redirect URL registration and provider config in Supabase dashboard
  }
}

When it happens

Trigger: Calling signInWithPKCE() when Supabase rejects the OAuth initiation: invalid provider, misconfigured redirect URL ('http://localhost:3421/auth/callback') not allowlisted in Supabase dashboard, or unreachable/invalid Supabase project.

Common situations: Redirect URL not registered in Supabase Auth settings, OAuth provider not enabled in the project, wrong Supabase URL, or network issues reaching the auth endpoint.

Related errors

• CODE_EXCHANGE_FAILED
• No refresh token received from server - session refresh will
• INVALID_RESPONSE
• PKCE_FAILED
• START_FLOW_FAILED

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/851165d836cfc7b9. Report an issue: GitHub.