Troubleshooting

Check:

• The client ID belongs to the selected environment.
• The redirect URI exactly matches a registered value.
• response_type is code.
• scope contains supported, space-separated values.
• PKCE uses code_challenge_method=S256.

Do not continue the login. Confirm the same browser received the transaction cookie, the cookie path and same-site settings cover the callback, and the transaction has not expired or already been used. Start a fresh login after the error.

Check:

• The authorization code has not expired or been used.
• The token request uses the same redirect URI as the authorization request.
• The original PKCE verifier matches the challenge.
• The client credentials and token endpoint belong to the same environment.
• The request is form encoded.

Send the access token as Authorization: Bearer …. Do not send an ID token, refresh token, or authorization code to UserInfo. If the access token is expired, use a valid refresh token on the server or start a new login.

Confirm the corresponding scope was requested and authorized. Profile claims can be optional, so implement a safe fallback and do not assume every account contains every field.

Verify the feature is enabled for the asset and included in its license. Standard Login, Analytics, and Campaign capabilities are licensed separately as described under Licenses.

For cache configuration on the WordPress side, use only cookies sent to the WordPress origin. The DocID^® WordPress plugin uses the following cookie patterns:

• docid_session_id identifies an authenticated DocID^® session. Configure full-page caches to bypass cached responses whenever this cookie is present.
• docid_oauth_binding_* is used temporarily while the browser completes OAuth login. Do not cache local OAuth start or callback requests, and bypass caching when a cookie with this prefix is present.
• wordpress_logged_in_*, wordpress_sec_* and wordpress_* are standard WordPress authentication cookie patterns used when native WordPress account provisioning is enabled. Keep the standard WordPress cache exclusions for logged-in users active, including customized equivalents if your site overrides the WordPress cookie constants.

Also exclude every DocID^®-protected URL and the local OAuth start, callback, logout, and error-notice requests from full-page caching. After changing cache rules, purge previously cached redirects for protected URLs. Match cookie names or prefixes only; never record complete cookie values in cache rules or logs.

Send support@docid.pro:

• The affected environment and asset
• The approximate timestamp and timezone
• A safe correlation or request ID
• The page and step where the problem occurred
• The OAuth error code, if one was returned

Never send client secrets, authorization codes, access tokens, refresh tokens, or full session cookies.