---
originalPath: >-
  .tmp-workos-clone/packages/docs/content/reference/sso/get-authorization-url/error-codes.mdx
---
### Error codes

If there is an issue generating an authorization URL, the API will return the original redirect URI with `error` and `error_description` query parameters. If provided, the `state` value will also be included.

```url title="Redirect URI with an error code"
https://your-app.com/callback?error=organization_invalid&error_description=No%20connection%20associated%20with%20organization&state=123456789
```

Possible error codes and the corresponding descriptions are listed below.

| Error code                                 | Description                                                                                                                                                                                                                                                                                                                        |
| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `access_denied`                            | The identity provider denied the user's access to the client application, or the user declined the OAuth authorization request at the identity provider.                                                                                                                                                                           |
| `ambiguous_connection_selector`            | A connection could not be uniquely identified using the provided connection selector (e.g., organization). This can occur when there are multiple SSO connections under the same organization. If you need multiple SSO connections for an organization, use the connection parameter to identify which connection to use for SSO. |
| `connection_domain_invalid`                | There is no connection for the provided domain.                                                                                                                                                                                                                                                                                    |
| `connection_invalid`                       | There is no connection for the provided ID.                                                                                                                                                                                                                                                                                        |
| `connection_strategy_invalid`              | The provider has multiple strategies associated per environment.                                                                                                                                                                                                                                                                   |
| `connection_unlinked`                      | The connection associated with the request is unlinked.                                                                                                                                                                                                                                                                            |
| `domain_connection_selector_not_allowed`   | This is a legacy error code that only applies if using the deprecated “domain” query parameter which is no longer valid for this endpoint. Use the “organization” or “connection” query parameters to target a connection instead.                                                                                                 |
| `idp_initiated_sso_disabled`               | IdP-initiated SSO is disabled for the connection (see [Disable IdP-initiated SSO](/sso/login-flows/idp-initiated-sso/disable-idp-initiated-sso-beta)).                                                                                                                                                                             |
| `invalid_connection_selector`              | A valid connection selector query parameter must be provided in order to correctly determine the proper connection to return an authorization URL for. Valid connection selectors are either `connection`, `organization`, or `provider`.                                                                                          |
| `organization_invalid`                     | There is no organization matching the provided ID.                                                                                                                                                                                                                                                                                 |
| `oauth_failed`                             | An OAuth authorization request failed for a user.                                                                                                                                                                                                                                                                                  |
| `profile_not_allowed_outside_organization` | A profile was received that has an `email` that is outside the [organization’s domain](/reference/domain-verification) and the organization does not allow this. To resolve this, add the missing domain to the organization's Domains. You can read about other options in the [SSO Domains guide](/sso/domains).                 |
| `server_error`                             | The SSO authentication failed for the user. More detailed errors and steps to resolve are available in the Sessions tab on the connection page in the WorkOS Dashboard.                                                                                                                                                            |
| `signin_consent_denied`                    | The user rejected the sign-in consent screen. This screen prompts the user to verify the email provided by the identity provider to confirm the legitimacy of the sign-in attempt.                                                                                                                                                 |