[Federated Login] oauthSignInError - An error occurred while validating the state.

[mhyassin]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React Native

Amplify APIs

Authentication, DataStore

Amplify Version

v6

Amplify Categories

auth, storage

Backend

Amplify CLI

Environment information

Details

# Put output below this line

 System:
    OS: macOS 26.0.1
    CPU: (10) arm64 Apple M1 Pro
    Memory: 120.63 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.16.0 - /Users/mohamedhisham/.nvm/versions/node/v22.16.0/bin/node
    Yarn: 3.6.4 - /Users/mohamedhisham/.nvm/versions/node/v22.16.0/bin/yarn
    npm: 10.9.2 - /Users/mohamedhisham/.nvm/versions/node/v22.16.0/bin/npm
    Watchman: 2025.04.28.00 - /opt/homebrew/bin/watchman
  Browsers:
    Chrome: 143.0.7499.41
    Firefox: 145.0.2
    Safari: 26.0.1
  npmGlobalPackages:
    @aws-amplify/cli: 14.1.1
    corepack: 0.32.0
    marked: 17.0.1
    npm: 10.9.2
    yarn: 1.22.22

Describe the bug

Some of our users are getting this Error when trying to use signInWithRedirect with the Google provider on Android.

I can't find any documentation on what this Error means

Expected behavior

Users are logged in correctly

Reproduction steps

I don't have any reproduction steps, but I've asked the users to uninstall and reinstall the app and they are still stuck.

The only special thing we're implementing is that we're overriding amplify's oauth redirectSignIn & redirectSignOut.
The reason for that is that our backend is providing the same user pool for multiple apps, and with not setting those explicitly Google SignIn fails on Android for every app except the first one mentioned in the callbacks set on Cognito.

amplifyconfig.oauth.domain = 'cognitoCustomDomain'; // because amplify doesn't support that
amplifyconfig.oauth.redirectSignIn = tenantConfig.deepLinkUrl;
amplifyconfig.oauth.redirectSignOut = tenantConfig.deepLinkUrl;
Amplify.configure(amplifyconfig);

Could it be the issue?

Code Snippet

// Put your code below this line.

Log output

Details

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

[osama-rizk]

Hi @mhyassin,

Thank you for creating this issue.

The issue occurs because the URL does not match what's registered in your Cognito User Pool's allowed callback URLs.

Here is how you can configure the redirect URLs in your auth resource:

// amplify/auth/resource.ts
export const auth = defineAuth({
 loginWith: {
   email: true,
   externalProviders: {
     google: {
       clientId: secret('GOOGLE_CLIENT_ID'),
       clientSecret: secret('GOOGLE_CLIENT_SECRET')
     },
     callbackUrls: [
       "yourapp://callback/",
       "anotherapp://callback/",
       // Add all your tenant-specific deep link URLs here
     ],
     logoutUrls: [
       "yourapp://signout/",
       "anotherapp://signout/",
     ],
   }
 }
});

Then ensure all these URLs are also registered in your Google OAuth client's "Authorized redirect URIs" in the Google Developer Console.

Please refer to the external identity providers documentation for the complete setup process.

Could you try this approach and let us know how it goes?