Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+17 more

    Repair OAuth PKCE Flow Mixups

    1

    Repair OAuth PKCE and authorization-flow mixups where state, nonce, redirect URI, code verifier, provider, tenant, session, or browser tab are matched to the wrong transaction.

    $8.99

    30-day refund guarantee

    Secure checkout via Stripe

    0 installsSecurity scanned

    See it in action

    You say

    Our TypeScript app stores one oauth_state and pkce_verifier per session. Starting Google login in one tab and Microsoft login in another overwrites both; the first callback can consume the second verifier. Repair with a fake IdP and controlled callbacks. Preserve providers, redirect allowlists, S256 PKCE, nonce, timeouts, token handling, and errors.

    Your agent does

    Authorization-transaction mixup found. Session-global state and verifier fields are overwritten by the newest tab, so callbacks are not bound to provider, redirect URI, or initiation generation. The repair creates one opaque transaction record per state, binds provider/tenant/redirect/nonce/verifier, consumes it atomically once, preserves S256 and all validation/token/error policy, and proves concurrent-tab, replay, timeout, and wrong-provider rejection with a fake IdP.

    What you get

    Prevent session state overwrites during concurrent login attempts.Fix 'invalid_grant' errors caused by PKCE verifier mismatches.Ensure redirect_uri consistency between authorization and token exchange.Implement deterministic local tests for OAuth callback race conditions.

    About this skill

    The problem

    Race conditions and session-scoped state often cause OAuth flows to collide when users open multiple tabs or retry logins. This leads to code_verifier mismatches, provider identity loss, and corrupted authorization transactions that are notoriously difficult to debug in production.

    What it does

    • Identifies where concurrent OAuth transactions overwrite shared session state or PKCE verifiers.
    • Enforces strict ownership between callbacks, cached state, and the specific transaction generation.
    • Fixes redirect URI mismatches between the authorization and token exchange phases.
    • Implements deterministic local IdP fakes to reproduce concurrency bugs without live secrets.
    • Redacts sensitive observability data while improving metrics for terminal failure reasons.

    Frameworks & tools

    Works with any repository using OAuth 2.0, OIDC, and PKCE. Compatible with Bash, Read, and Edit toolsets for codebase patching.

    Why this beats prompting it yourself

    General LLMs often suggest insecure workarounds like increasing timeouts or loosening validation. This skill follows a mandatory safety discipline that preserves strict PKCE and OIDC specs while fixing the underlying state synchronization logic.

    Use cases

    • Fixing "invalid_grant" errors caused by multiple browser tabs overwriting session cookies.
    • Correcting flows where a callback for Provider A inadvertently attempts to resume a flow for Provider B.
    • Ensuring one-time state consumption to prevent replay or reuse of authorization codes.
    • Patching mismatched redirect_uri parameters across complex multi-tenant environments.

    Known limitations

    Requires access to repository files to perform analysis. Cannot interact with production services or read live secrets.

    How to install

    Drop the file into your AI Agent. Works with Claude, Cursor, ChatGPT, and 20+ more.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean today

    • One-time purchase, yours forever

    Listedtoday

    Frequently Asked Questions