ResolvedMinor impact
Convoy Web — Intermittent OAuth sign-in state mismatch
- Started
- 15 Oct 2026, 14:30 UTC
- Duration
- 1h 29m
- Affected components
- Convoy WebAuthentication & Sign-in
Updates
Investigating
We are investigating reports of intermittent "state_mismatch" authentication errors affecting staff and users signing in to Convoy Web via Accounts.
Identified
Root cause identified: concurrent 401 redirects and sibling-tab sign-in attempts were overwriting the single-transaction authorization state cookie before callback exchange, leading to state mismatches upon return.
Resolved
Resolved. Deployed a multi-transaction authorization state queue (retaining up to 5 concurrent states with 10-minute TTL), added a client-side single-flight navigation guard to eliminate redundant redirect cascades, and cleared shadowed parent-domain cookies. Fix is verified in production.