I’m having the same issue. But I verified against Chrome, Safari, and Firefox on Mac OS where they all behave the same - 401 response. You may also see an error in your Console that says “Invalid State”.
There seems to be a number of different ways that Invalid State can be caused.
- Bug with SPA JS that was fixed a year ago: Always "Invalid state" in v1.2 · Issue #186 · auth0/auth0-spa-js · GitHub
- Other ways Invalid State can be caused: Invalid state on reload Auth0 callback url, using auth0-spa-js and Angular 8 - #9 by supun
The underlying theme is that there is a misconfiguration somewhere that is causing this behavior. But I can’t isolate it in my environment - yet.