Common Errors & Practical Solutions

#1. Error: "invalid_redirect_uri" (OAuth Authorization)

Symptom: When attempting to sign in to a connected tool, NSGO displays an error indicating the redirect URI is invalid.

Cause: The redirect_uri query parameter sent by the client application does not match any URI allowlisted in the oauth_clients table for that client_id.

Solution: Ensure your client application configuration exactly matches the registered URI, including protocol (https vs http), port (e.g. :3000), and path (e.g. /api/auth/callback/nsgo). Trailing slashes must match exactly.

#2. Error: "invalid_grant: code_verifier mismatch" (Token Exchange)

Symptom: During token exchange, /api/oauth/token returns HTTP 400 with an invalid grant error.

Cause: The code_verifier sent in the POST body does not match the code_challenge computed during the initial authorization request, or the 5-minute code expiration window elapsed.

Solution: Ensure your client application stores the code_verifier in a secure, signed httpOnly cookie during the redirect step, and reads it back during the callback without mutation. Authorization codes are strictly single-use; replay attempts will fail.

#3. Error: "Username updated within the last 7 days"

Symptom: Attempting to update your @handle fails with a cooldown error.

Cause: Your account previously modified its handle less than 7 days ago. NSGO database RPC update_username() enforces an atomic 168-hour cooldown.

Solution: Check the "Eligible to change again" date displayed in the Profile Editor (/account/profile). Once the 7-day period expires, you can submit your new handle.

#4. Why is my profile not showing on the Leaderboard?

Check the following three conditions:

1. Profile Visibility: If your profile is set to "Private" or "Unlisted" at /account/privacy, it is automatically excluded from the public leaderboard.

2. Leaderboard Toggle: Verify that the "Show on Leaderboard" toggle at /account/privacy is enabled.

3. Verified Score: Unranked accounts have 0 verified XP. Visit /account/achievements and click "Check For Badges" to audit your score.

#5. What should I do if I notice an unfamiliar active session?

1. Visit /account/sessions immediately.

2. Click "Revoke Session" on the suspicious device, or click "Revoke Other Sessions" to terminate all external logins.

3. Navigate to /account/security and update your password immediately.