Hi friends 👋. Trying to get my head around Hydra. I need to use it for SPAs and native Mobile Apps. What I have learned from your documentation and (excellent) blog posts is, that I should not use the “Implicit Flow” anymore but rather go for “authorize code + PKCE”. No I wanted to give it a go for a React SPA. According to the docs, creating a client for this scenario is as simple as this:

hydra clients create \
  --endpoint <http://localhost:4445> \
  --id my-frontend-client \
  --token-endpoint-auth-method none

Is that really all I need to create a new client for my SPA? No redirect URI or anything else? However, when I try to kick-off the flow like this…

window.location.href = `${this.hydraPublicUrl}/oauth2/auth?response_type=code&client_id=my-frontend-client`;

…I receive an error (screenshot below). However, when I create the client by passing the

--callbacks <http://localhost:3000/callback>

flag and then navigating the browser to

${this.hydraPublicUrl}/oauth2/auth?response_type=code&client_id=my-frontend-client&redirect_uri=<http://localhost:3000/callback>

, the browser directly navigates to the Callback page without showing a Login Screen and gives me that message in the URL:

<http://localhost:3000/callback?error=invalid_state&error_description=The+state+is+missing+or+does+not+have+enough+characters+and+is+therefore+considered+too+weak.+Request+parameter+%27state%27+must+be+at+least+be+8+characters+long+to+ensure+sufficient+entropy.&state=>

Must be something, I am overlooking here. Can you give me a hint?