OIDC with Hello.Dev Invalid_Client Error

[murfasa]

Description

Hi, thank you for your work on this awesome project! Upgrading from wireguard+wg-dashboard to headscale+headplane has been a breeze.

Unfortunately, I am having a similar issue as #311 while trying to get OIDC set up with hello.dev. Already have it working with headscale connected to hello.dev.

I was able to get OIDC login working on v0.6.2-beta.2 and v0.6.2-beta.3, however the Machines page breaks when I downgrade to that version. Did not work on v0.6.2-beta.4 and up.

Any ideas or suggestions?

Configuration Issue(s)
Authentication with the SSO provider failed. Please try again later. Headplane logs may provide more information.

2026-03-08T02:58:30.871Z [auth] ERROR: Got an OIDC response error body: {"error":"invalid_client","error_description":"client_id does not match session client_id"}
Headplane config:

oidc:
  enabled: true
  issuer: "https://issuer.hello.coop"
  headscale_api_key: "REDACTED"
  client_id: "app_REDACTED"
  client_secret: "REDACTED"
  use_pkce: true
  disable_api_key_login: false

Headplane Version

v0.6.2 (latest)

Headscale Version

v0.28.0 (stable)

[tale]

Is your issuer missing a trailing slash by any chance? I know specific IdPs are very strict about this. Also it seems like there may just be cookie issues that might be fixed from clearing cookies. I'll have to investigate on my own, but just some initial suggestions.