Summary: Authorizing a Custom OAuth (Adobe IMS) connector consistently fails at the final callback step with {"error":{"code":"bad_request","message":"Missing CSRF state or origin"}}, despite a clean single attempt in a standard browser with no cookie blocking.
Details:
- Connector: oauth/frameio (Custom OAuth, Adobe IMS as provider)
- Flow: server calls startAuthorization() (/connect v0.6.1) → browser redirected to https://connect.vercel.com/authorize/sca_DS4xkNHl7pvp7pC-D6egUFSPsMkG9ZWE52kcmMjbTy8 → click Continue → redirected to Adobe (ims-na1.adobelogin.com) → login + consent succeed → Adobe redirects to https://api.vercel.com/v1/connect/callback?code=...&state=e68edb90dea7a3fad12eaa08b99245640cdffd3c → error page shown at this point.
- The state parameter is clearly present and well-formed in the callback URL, so the error message appears to not reflect the actual condition — likely no matching server-side record found for that state/session.
- Reproduced on the deployed production app (****.vercel.app), not the v0 preview.
- Single clean attempt, no retries, standard Chrome/Edge/Firefox, no incognito, no cookie-blocking extensions.
- No errors appear in the project's own runtime/function logs, consistent with the failure happening entirely within Vercel's hosted connect.vercel.com → api.vercel.com flow before any request reaches the app's returnUrl.
Please advise. Thank you.