The sequence diagram below illustrates the full PKCE flow.
| Error Message | Likely Cause | Solution | |---------------|--------------|----------| | invalid_request | Missing code_challenge_method | Ensure S256 is passed | | unauthorized_client | Incorrect redirect_uri | Must exactly match registration (including trailing slash) | | access_denied | User denied consent | Prompt user to re‑authorize | | invalid_grant | Reused authorization code | Codes are single‑use; obtain a new one | lexoffice.login
lexoffice takes security seriously. If you have 2FA enabled, make sure your smartphone is nearby to approve the login or enter the generated code. The sequence diagram below illustrates the full PKCE flow