How to fix: Supabase Google OAuth PKCE Flow: "both auth code and code verifier should be non-empty" Error

This Supabase/Next.js failure usually means the OAuth callback lost the PKCE verifier cookie before Supabase exchanged the code. Keep the login and callback URLs aligned, let Supabase exchangeCodeForSession handle the code, and retest the full provider redirect.

This pattern is common in AI-built Next.js and Supabase apps because generated code often leaves auth, cookie, deployment, or type boundaries unfinished. The exact symptom matters, so preserve the original error before changing code.

Why it happens

The OAuth callback is trying to exchange a code without the matching PKCE verifier that Supabase stored when the login started.

What to check

Confirm the `redirectTo` URL exactly matches the route registered in Supabase and Google, including path and protocol.

Check whether middleware or route groups strip, overwrite, or redirect before the `code` reaches the callback route.

Verify the browser client uses Supabase's PKCE storage and the callback uses `exchangeCodeForSession(code)` instead of a hand-built token request.

Inspect cookie names and SameSite/Secure attributes on the auth domain after clicking the provider login.

Fix plan

Use Supabase's callback pattern: read `code` from the URL and call `exchangeCodeForSession(code)` in the callback route.

Stop manually decoding the verifier unless you are replacing Supabase's storage contract end-to-end.

Keep the login route, callback route, and middleware public enough that the verifier cookie survives the redirect.

Add a local callback smoke that checks missing-code and bad-code errors produce a clear redirect instead of a blank failure.

When to stop guessing

If this touches auth, RLS, database writes, storage, redirects, or deployment callbacks, a build-only fix is not enough. Verify the real user path against the same Supabase project and domain that failed.

Need a second set of eyes? Paste the exact error into the free diagnosis form and get a focused rescue plan before you spend more time guessing.