Auth.js · server log
InvalidCheck (PKCE / state)
[auth][error] InvalidCheck: pkceCodeVerifier value could not be parsed. Read more at https://errors.authjs.dev#invalidcheckWhat it means
Auth.js sets a short-lived cookie when sign-in starts and checks it when the provider sends the user back. The cookie was missing on the way back.
Common causes
- Starting on 127.0.0.1 and coming back to localhost (or www vs no www): different cookie jars
- The callback lands on a different domain than the one sign-in started on
- Cookies blocked in the browser, or a custom cookies config
How to fix it
- Use one exact origin everywhere: the address bar, the OAuth app and any AUTH_URL
- Redirect www to the apex domain (or the reverse) at the host
- Remove custom cookies options unless you need them
Prompt for Cursor or Claude Code
GitHub sign-in fails with InvalidCheck (pkceCodeVerifier). Check whether sign-in starts and returns on the same origin (localhost vs 127.0.0.1, www vs apex), and whether my config overrides cookies.Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Auth.js error fixer.
next: skip the next one
Skip the setup. The VibeBoot SaaS Starter ships Auth.js v5 already wired (GitHub sign-in, optional email magic links, Prisma adapter), plus Stripe and a database on Next.js 16.4.3. $49, one-time.
14-day money-back guarantee · lifetime updates
Other Auth.js errors
$ fixed it? get the next one first
New fixes for what AI agents break, by email.
When we add a fix or a Cursor rule for a new Next.js, Auth.js, Prisma or Stripe break, it goes out in the VibeBoot newsletter. Free, occasional, unsubscribe in one click.