Hi @truescope,
The state is only encoded if something is set by the client application in the /authorize request.
For example, when the client application passed the state abc123 in the authorization request:
tenant.auth0.com/authorize?...&state=abc123
Then it will be passed back to the client application with the redirect to the callback URL:
/callback?...&state=xyzABC123
You can read more about the state param in our docs:
In order to help troubleshoot what might be causing the loop, would you mind sharing which SDK you are using in your app?
Have you been able to replicate the issue in an incognito window? This behavior could be caused by blocked third-party cookies.
Are you seeing any related tenant logs of failed silent auth?
Thank you,
Stephanie