xtekky/gpt4free · error · RuntimeError

Missing PKCE verifier in state parameter

Error message

Missing PKCE verifier in state parameter

What it means

During OAuth code exchange, the state parameter is base64-decoded and must contain a 'verifier' field (the PKCE code_verifier generated when the authorization URL was built). This error means the state passed to exchange_code_for_tokens has no verifier — usually because a hand-built or altered state string was used instead of the one returned by build_authorization_url.

Source

Thrown at g4f/Provider/needs_auth/Antigravity.py:623

        code: str,
        state: str,
    ) -> Dict[str, Any]:
        """
        Exchange authorization code for access and refresh tokens.

        Args:
            code: Authorization code from OAuth callback
            state: State parameter containing PKCE verifier

        Returns:
            Dict containing tokens and user info
        """
        decoded_state = decode_oauth_state(state)
        verifier = decoded_state.get("verifier", "")
        project_id = decoded_state.get("projectId", "")

        if not verifier:
            raise RuntimeError("Missing PKCE verifier in state parameter")

        start_time = time.time()

        # Exchange code for tokens
        async with aiohttp.ClientSession() as session:
            token_data = {
                "client_id": cls.OAUTH_CLIENT_ID,
                "client_secret": cls.OAUTH_CLIENT_SECRET,
                "code": code,
                "grant_type": "authorization_code",
                "redirect_uri": ANTIGRAVITY_REDIRECT_URI,
                "code_verifier": verifier,
            }

            async with session.post(
                "https://oauth2.googleapis.com/token",
                data=token_data,
                headers={

View on GitHub (pinned to 973504e177)

Solutions

1. Always generate the authorization URL via cls.build_authorization_url() and use the state it returns, unchanged, in the exchange.
2. In manual paste mode, paste the FULL redirect URL (including the complete state query parameter), not just the code.
3. Restart the login flow from scratch so a fresh state/verifier pair is created.
4. Upgrade g4f so the state encoding used to build and decode matches.

Example fix

# before: hand-rolled state breaks PKCE
state = "mypayload"  # no verifier -> RuntimeError

# after: use the provider's own PKCE URL builder
auth_url, state, verifier = Antigravity.build_authorization_url()
# ... after redirect, pass the callback's state back verbatim:
tokens = await Antigravity.exchange_code_for_tokens(code, callback_state)

from g4f.Provider.needs_auth.Antigravity import decode_oauth_state

def state_has_verifier(state: str) -> bool:
    try:
        return bool(decode_oauth_state(state).get("verifier"))
    except Exception:
        return False

# before exchange:
assert state_has_verifier(callback_state), "state lost its PKCE verifier; restart login"

def is_valid_pkce_state(state: str) -> bool:
    """True when the OAuth state decodes and carries a PKCE verifier."""
    try:
        decoded = decode_oauth_state(state)
    except Exception:
        return False
    return isinstance(decoded, dict) and bool(decoded.get("verifier"))

try:
    tokens = await Antigravity.exchange_code_for_tokens(code, state)
except RuntimeError as e:
    if "Missing PKCE verifier" in str(e):
        auth_url, state, _ = Antigravity.build_authorization_url()  # restart flow
        raise

When it happens

Trigger: exchange_code_for_tokens(code, state) where decode_oauth_state(state) yields no 'verifier' key. Happens when the caller fabricates the state, truncates the redirect URL when pasting it in manual mode, or uses a state from a different/older authorization session.

Common situations: User pastes only part of the redirect URL in the manual login flow; the authorization URL was built by an old provider version with a different state schema; custom login scripts that pass their own state parameter.

Related errors

• Missing PKCE verifier in state parameter
• OAuth error: {OAuthCallbackHandler.callback_error}
• Failed to read OAuth credentials from {path}: {e}
• No refresh token found in credentials.
• Token refresh failed: {text}

AI-assisted analysis of xtekky/gpt4free@973504e177 (2026-08-14). Data as JSON: /api/errors/a62b7a0c3397aa2c. Report an issue: GitHub.