zed-industries/zed · error

OAuth state mismatch

Error message

OAuth state mismatch

What it means

The `state` query parameter returned in the OAuth callback does not match the value generated for this authorization request. This is the standard CSRF guard for OAuth; a mismatch means the callback belongs to a different or stale flow, or the state was tampered with.

Source

Thrown at crates/openai_subscribed/src/openai_subscribed.rs:1171

        // Deliberately excludes `api.connectors.read api.connectors.invoke`
        // (which Codex CLI requests): extra scopes inflate the
        // access-token JWT, and the serialized credentials must fit within
        // Windows Credential Manager's 2560-byte blob limit
        // (CRED_MAX_CREDENTIAL_BLOB_SIZE). See #58541.
        .append_pair("scope", "openid profile email offline_access")
        .append_pair("response_type", "code")
        .append_pair("code_challenge", &challenge)
        .append_pair("code_challenge_method", "S256")
        .append_pair("id_token_add_organizations", "true")
        .append_pair("state", &oauth_state)
        .append_pair("codex_cli_simplified_flow", "true")
        .append_pair("originator", "zed");

    // Open browser AFTER the listener is ready
    cx.update(|cx| cx.open_url(auth_url.as_str()));

    // Await the callback
    let callback = callback_rx
        .await
        .map_err(|_| anyhow!("OAuth callback was cancelled"))?
        .context("OAuth callback failed")?;

    // Validate CSRF state
    if callback.state != oauth_state {
        return Err(anyhow!("OAuth state mismatch"));
    }

    let tokens = exchange_code(&http_client, &callback.code, &verifier, &redirect_uri)
        .await
        .context("Token exchange failed")?;

    let jwt = tokens
        .id_token
        .as_deref()
        .unwrap_or(tokens.access_token.as_str());
    let claims = extract_jwt_claims(jwt);

View on GitHub (pinned to 5a9b9558db)

Solutions

1. Discard the callback and restart sign-in to generate a fresh state
2. Close any other tabs or sessions mid-sign-in that could deliver a stale callback
3. If it persists, verify nothing on the network path rewrites redirect URLs

When it happens

Trigger: Thrown at crates/openai_subscribed/src/openai_subscribed.rs:1139 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zed-industries/zed@5a9b9558db (2026-08-20). Data as JSON: /api/errors/11dd2b52803fd399. Report an issue: GitHub.