# The session token is invalid: State in the token does not match the /continue state **URL:** \ **Category:** Get Help\ **Tags:** jwt, rules, redirect, login\ **Created:** [February 9, 2022, 4:19am UTC](https://community.auth0.com/t/the-session-token-is-invalid-state-in-the-token-does-not-match-the-continue-state/77930 "2022-02-09T04:19:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![alexandre.boulay](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alexandre.boulay/32/33806_2.png) [@alexandre.boulay](https://community.auth0.com/u/alexandre.boulay)\ **Post date:** [February 9, 2022, 4:19am UTC](https://community.auth0.com/t/the-session-token-is-invalid-state-in-the-token-does-not-match-the-continue-state/77930/1 "2022-02-09T04:19:25Z")
Hi, I am using passwordless login with email as a provider along with some social providers. Sometimes, I won’t get the chance to capture the first name and the last name of the user. As such, I am trying to implement a progressive profiling flow. I thought about using Actions because it looks to offer exactly what I need. However, I am facing an issue related to session token and I would like some help to figure out what I am missing or doing wrong. Here are the steps I am currently doing: 1. Inside `onExecutePostLogin`, I redirect my user to [myapp.com/onboarding](http://myapp.com/onboarding) using `api.redirect.sendUserTo`. At this point, things are working fine and the user gets redirected correctly with the url containing the state and session\_token. 2. Once I capture the data I need from my user, I generate a JWT token with the secret: 1234(temporary) 3. I then call the `/continue` method to invoke `onContinuePostLogin` within my Action. That seems to be working. However, once the action calls `api.redirect.validateToken` with my dummy secret(1234), I get the following message: `The session token is invalid: State in the token does not match the /continue state.` From that point, I am not sure what I am doing wrong, I am guessing it’s in terms of how I generate my token, however I am not sure exactly. Any pointers would be appreciated. Thank you. ---
**Author:** ![alexandre.boulay](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alexandre.boulay/32/33806_2.png) [@alexandre.boulay](https://community.auth0.com/u/alexandre.boulay)\ **Post date:** [February 9, 2022, 2:09pm UTC](https://community.auth0.com/t/the-session-token-is-invalid-state-in-the-token-does-not-match-the-continue-state/77930/2 "2022-02-09T14:09:59Z")
After a good night of sleep, I realized that I simply did not include `state` inside my token. Everything is working now. Reading this really clarified it for me: > **[Redirect with Actions](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/redirect-with-actions#pass-information-back-to-the-action)** > > Learn how to use post-login Actions to redirect users before an authentication transaction is complete. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [February 22, 2022, 2:34pm UTC](https://community.auth0.com/t/the-session-token-is-invalid-state-in-the-token-does-not-match-the-continue-state/77930/3 "2022-02-22T14:34:53Z")
No worries! We’ve all been there! Thanks for sharing with the rest of community! ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 9, 2022, 2:35pm UTC](https://community.auth0.com/t/the-session-token-is-invalid-state-in-the-token-does-not-match-the-continue-state/77930/4 "2022-03-09T14:35:41Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.