n8n - 💡(How to fix) Fix 🚨 [BUG] OAuth2 credential authentication fails with "state parameter too long" — n8n embeds oversized encrypted payload in OAuth `state`, breaking compatibility with strict OAuth providers

Describe the problem/error/question

When attempting to authenticate with an OAuth2 credential in n8n, the OAuth authorization flow fails because n8n encodes a large encrypted payload into the state parameter of the OAuth redirect URL. Some OAuth providers enforce a strict maximum length on the state parameter, causing the authentication to be rejected before it even begins.

This issue affects any OAuth2 integration where the target service has a short state parameter length limit (e.g., 256 or 512 characters). The n8n-generated state value consistently exceeds these limits because it contains a Base64-encoded JSON object with an encrypted data field.

ERROR ON THIS MCP SERVER: https://mcp.leanix.net/services/mcp-server/v1/mcp

What is the error message (if any)?

The OAuth provider returns the following error in the redirect callback URL:

Received following query parameters: {
  "error": "invalid_request",
  "error_description": "state parameter too long",
  "state": "eyJ0b2tlbiI6IkZmcWtuNE83LTRUNCATED"
}

Decoding the state value reveals it is a JSON object:

{
  "token": "FfqknO7-xxxxxxxxxxxxxxx",
  "createdAt": 1779267098631,
  "data": "<encrypted callback data>"
}

The data field contains an AES-encrypted payload that stores session context, making the overall state string too long for strict OAuth providers.

Please share your workflow/screenshots/recording

The error occurs during the OAuth2 credential setup flow (not within a specific workflow node). Steps to reproduce:
1. Create a new credential in n8n using any OAuth2 credential type
2. Click "Connect my account" / "Sign in with OAuth2"
3. n8n redirects to the OAuth provider's authorization page with a `state` parameter
4. The OAuth provider rejects the request immediately with "state parameter too long"
5. The user is redirected back to n8n with the error shown above

Share the output returned by the last node

No output

Expected behavior

n8n should either (a) store the OAuth session state server-side (e.g., in the database) and only pass a short opaque token as the state parameter, or (b) compress/truncate the state payload to stay within the OAuth spec's practical limits, ensuring compatibility with providers that enforce strict state length limits.

Debug info

core

• n8nVersion: 2.21.4
• platform: docker (self-hosted)
• nodeJsVersion: 24.15.0
• nodeEnv: production
• database: postgres
• executionMode: scaling (multi-main)
• concurrency: 50
• license: enterprise (production)

storage

• success: all
• error: all
• progress: false
• manual: true
• binaryMode: s3

pruning

• enabled: true
• maxAge: 336 hours
• maxCount: 10000 executions

client

• userAgent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/148.0.0.0 safari/537.36
• isTouchDevice: false

Generated at: 2026-05-21T03:54:21.877Z