Troubleshooting

The authorization request is rejected

Check:

• The client ID belongs to the selected environment.
• The redirect URI exactly matches a registered value.
• response_type is code.
• scope contains supported, space-separated values.
• PKCE uses code_challenge_method=S256.

The callback reports a state mismatch

Do not continue the login. Confirm the same browser received the transaction cookie, the cookie path and same-site settings cover the callback, and the transaction has not expired or already been used. Start a fresh login after the error.

Token exchange fails

Check:

• The authorization code has not expired or been used.
• The token request uses the same redirect URI as the authorization request.
• The original PKCE verifier matches the challenge.
• The client credentials and token endpoint belong to the same environment.
• The request is form encoded.

UserInfo is unauthorized

Send the access token as Authorization: Bearer …. Do not send an ID token, refresh token, or authorization code to UserInfo. If the access token is expired, use a valid refresh token on the server or start a new login.

An expected profile field is missing

Confirm the corresponding scope was requested and authorized. Profile claims can be optional, so implement a safe fallback and do not assume every account contains every field.

A feature is unavailable

Verify the feature is enabled for the asset and included in its license. Standard Login, Analytics, and Campaign capabilities are licensed separately as described under Licenses.

Information to include in a support request

Send support@docid.pro:

• The affected environment and asset
• The approximate timestamp and timezone
• A safe correlation or request ID
• The page and step where the problem occurred
• The OAuth error code, if one was returned

Never send client secrets, authorization codes, access tokens, refresh tokens, or full session cookies.