# Invalid Token: \`state\` does not match when redirecting to /authorize

**URL:** <https://community.auth0.com/t/invalid-token-state-does-not-match-when-redirecting-to-authorize/65138>\
**Category:** Get Help\
**Tags:** nodejs, login\
**Created:** [June 27, 2021, 8:06am UTC](https://community.auth0.com/t/invalid-token-state-does-not-match-when-redirecting-to-authorize/65138 "2021-06-27T08:06:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![reuvenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/reuvenk/32/25639_2.png) [@reuvenk](https://community.auth0.com/u/reuvenk)\
**Post date:** [June 27, 2021, 8:06am UTC](https://community.auth0.com/t/invalid-token-state-does-not-match-when-redirecting-to-authorize/65138/1 "2021-06-27T08:06:09Z")

</div>

Hi,

I have a webapp (react/node) using auth0.

The auth is started using WebAuth.authorize and validated on return using WebAuth.parseHash. Everything works fine.

My problem is that I need to create another flow in a different app, that will redirect to the login page and let the user log in to the app.

I am redirecting to [my-domain.auth0.com/authorize](http://my-domain.auth0.com/authorize) using the params as defined here: [Authentication API Explorer](https://auth0.com/docs/api/authentication#database-ad-ldap-passive-) The login succeeds, but then it fails inside my app on the WebAuth.parseHash() phase, with the error ‘Invalid Token: `state` does not match’

As far as I can see, my app is not explicitly setting a state on the authorize call, and neither am I on the /authorize url.

What am I doing wrong and how can I fix this? Thanks!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [June 28, 2021, 7:08pm UTC](https://community.auth0.com/t/invalid-token-state-does-not-match-when-redirecting-to-authorize/65138/3 "2021-06-28T19:08:47Z")

</div>

Hi @reuvenk,

Welcome to the Community!

If you simply want to redirect to the login page from a different app, you could consider using a [default login route](https://auth0.com/docs/universal-login/configure-default-login-routes). Let me know if this doesn’t solve the problem.

---

<div class="post-metadata">

**Author:** ![reuvenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/reuvenk/32/25639_2.png) [@reuvenk](https://community.auth0.com/u/reuvenk)\
**Post date:** [June 29, 2021, 12:04pm UTC](https://community.auth0.com/t/invalid-token-state-does-not-match-when-redirecting-to-authorize/65138/4 "2021-06-29T12:04:29Z")

</div>

Hi,  
I have a few apps using the same login, and I need to pass the redirect uri parameter to send to a specific app, so that won’t help me

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [June 29, 2021, 4:18pm UTC](https://community.auth0.com/t/invalid-token-state-does-not-match-when-redirecting-to-authorize/65138/5 "2021-06-29T16:18:28Z")

</div>

It sounds like you should be registering multiple apps for this.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [August 23, 2021, 4:19pm UTC](https://community.auth0.com/t/invalid-token-state-does-not-match-when-redirecting-to-authorize/65138/6 "2021-08-23T16:19:47Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.