[Bug]: T3 Connect desktop OAuth callback fails — Clerk rejects response_type / 'Invalid T3 Connect authorization callback' (Windows, v0.0.30-v0.0.32-nightly)

Area

apps/desktop (T3 Connect CLI OAuth flow) / Clerk integration

Steps to reproduce

On Windows 11, run npx t3 connect (tested clean on v0.0.30, v0.0.31, and v0.0.32-nightly.20260730.959 — same result on all three).
Confirm the relay-client install prompt (y).

CLI prints an authorize URL:

https://clerk.t3.codes/oauth/authorize?client_id=hzxSgY2cH10sDU2r&redirect_uri=http%3A%2F%2F127.0.0.1%3A34338%2Fcallback&response_type=code&scope=openid+profile+email&state=<state>&code_challenge=<challenge>&code_challenge_method=S256

Open the URL in a browser and sign in with an existing T3 account.

Expected behavior

Browser completes the Clerk OAuth flow and redirects to http://127.0.0.1:34338/callback?code=...&state=..., which the waiting CLI picks up to finish pairing.

Actual behavior

Two different failure modes observed across attempts, both from the same root cause:

Mode A — Clerk redirects immediately with an OAuth error, before any sign-in UI:

http://127.0.0.1:34338/callback?error=unsupported_response_type&error_description=The+authorization+server+does+not+support+obtaining+a+token+using+this+method.+%60The+request+is+missing+the+%27response_type%27+parameter.&state=

Note response_type=code is present in the outbound authorize URL, and state comes back empty in the error redirect even though the outbound URL had a real value — indicating Clerk rejects the request before honoring the query params it was given.

Mode B — after actually completing sign-in in the browser: Invalid T3 Connect authorization callback.

In both modes, the CLI eventually exits with:

CloudCliAuthorizationError: Could not authorize the T3 Connect CLI.
  [cause]: CloudCliAuthorizationTimeoutError: Timed out waiting for T3 Connect authorization.
    [cause]: TimeoutError

Impact

Major — npx t3 connect cannot complete pairing at all on this machine/account, across three consecutive released versions.

Version or commit

v0.0.30
v0.0.31
v0.0.32-nightly.20260730.959

Environment

Windows 11, Node v24.12.0, run from Git Bash / PowerShell, both with and without a browser auto-opened by the CLI (tried Enter to open browser).

Notes

Likely related to the cluster of other very recent Clerk/T3-Connect auth bugs filed around the same time: #4815, #4840, #4915, #4934. This report is the desktop-browser OAuth authorize/callback path specifically (not the headless-SSH state/PKEC fragment flow in #4934, and not the non-loopback-bind "relay offline" case in #4915) — filing separately since none of those match this exact symptom.

Workaround

None found. Fell back to t3 serve --tailscale-serve (headless server + Tailscale Serve HTTPS proxy + manual pairing token/URL) to get cross-machine access working instead.

Reopening — retested and this is still broken, on a build cut after this issue was closed.

Retested npx t3@nightly connect just now (nightly resolved to 0.0.32-nightly.20260731.961, which post-dates the close at 2026-07-30T22:25:04Z). Same exact failure:

Fresh authorize URL generated with a valid response_type=code, state, and code_challenge.
Browser flow ends with: Invalid T3 Connect authorization callback.
CLI times out the same way as before (CloudCliAuthorizationError → CloudCliAuthorizationTimeoutError → TimeoutError).

The only related fix I can find in the commit log around the close time is fbecb73 (bump Clerk Electron SDK to 0.0.24, register t3code:// scheme on Linux) — but that's the Electron deep-link path for the desktop app, not this CLI's http://127.0.0.1:34338/callback OAuth flow, so it doesn't look like it should have touched this code path. Happy to grab more diagnostics (HAR of the browser flow, --log-level trace CLI output, etc.) if that helps narrow it down.

Retested on current stable t3 v0.0.33 (Windows). Summary: still broken in the desktop flow, but the headless flow authorizes fine — which isolates this to the loopback callback path rather than the CLI's OAuth/PKCE generation.

Desktop flow — still fails. npx t3@latest connect login emits the same authorize URL shape as in the original report:

https://clerk.t3.codes/oauth/authorize?client_id=<redacted>&redirect_uri=http%3A%2F%2F127.0.0.1%3A34338%2Fcallback&response_type=code&scope=openid+profile+email&state=<redacted>&code_challenge=<redacted>&code_challenge_method=S256

Same outcome as before: Invalid T3 Connect authorization callback, then the CLI times out.

Headless flow — works. npx t3@latest connect login --headless on the same version, same machine, same account succeeds. It uses a different endpoint entirely:

https://app.t3.codes/connect#state=<redacted>&challenge=<redacted>

Sign-in completes, the pasted code is accepted, and the CLI reports a successful sign-in. connect status then shows "authenticated": true, and connect link authorizes the environment normally.

Why this narrows it down: both flows are driven by the same CLI build and generate state/code_challenge the same way, and the headless one round-trips successfully. So the fault is not in the parameters the CLI produces — it is specific to the clerk.t3.codes/oauth/authorize → 127.0.0.1:34338/callback leg. That also explains why the Electron/Linux deep-link fix referenced around the original close did not affect this.

Workaround for anyone hitting this on Windows: use --headless and paste the code back. It must be run in a real interactive terminal — piping stdin makes the code prompt hit EOF and exit immediately.

Worth reopening, since the closure predates this and the reported path is still failing on the latest stable.

feat(scripts): guard fork prose against live upstream citations

Navigation Menu

Repository navigation

[Bug]: T3 Connect desktop OAuth callback fails — Clerk rejects response_type / 'Invalid T3 Connect authorization callback' (Windows, v0.0.30-v0.0.32-nightly) #5051

Area

Steps to reproduce

Expected behavior

Actual behavior

Impact

Version or commit

Environment

Notes

Workaround

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug]: T3 Connect desktop OAuth callback fails — Clerk rejects response_type / 'Invalid T3 Connect authorization callback' (Windows, v0.0.30-v0.0.32-nightly) #5051

Description

Area

Steps to reproduce

Expected behavior

Actual behavior

Impact

Version or commit

Environment

Notes

Workaround

Activity

russlib commented on Jul 31, 2026

russlib commented on Aug 11, 2026

8 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions