When iOS Todoist code_challenge fails on the first attempt

On Grok Bot iOS, reconnecting Todoist can open Todoist’s authorize page and fail once with code_challenge required for public clients (JSON on app.todoist.com). An immediate retry often reaches Allow. Staff (Colin, Sep 8, 2026): the error page is Todoist’s authorize server; every Bot-generated sign-in link includes a PKCE code_challenge. The param is likely dropped between open and Todoist (for example a Todoist login refresh that loses the query). That matches first-fail / immediate-retry. Support (Michael): every generated link had code_challenge; tracking as an iOS in-app reconnect issue. Thread: forum 170895.

What to do

1. In the iOS app, start Todoist connect again right away. Finish Allow on the retry while the query string is intact.
2. If the same code_challenge error keeps repeating across several fresh links, connect Todoist from desktop when desktop OAuth is healthy for you.
3. Note desktop may hit a separate known issue where Authenticate never opens a browser (When desktop Todoist Authenticate never opens a browser, forum 171183). Pick the surface that actually reaches OAuth for your account.

Distinct clusters

• Desktop Todoist: Authenticate never starts OAuth (toast / unreachable) — product-side; uninstall loops will not help.
• iOS here: the browser/authorize page opens; PKCE is present on the generated link and can be lost before Todoist accepts it.

Pitfalls

• Stopping after the first authorize error when a second connect often works.
• Assuming the Bot omitted code_challenge — staff and support checked generated links and found it present.