idp-troubleshoot-auth-errors

Symptom-driven troubleshooting guide for HTTP/transport errors when integrating the Overlens IDP — the "why am I getting this status code?" skill. Use this whenever a developer is BLOCKED by an error response from the IDP or from their own auth flow and needs to map symptom → cause → fix: `401 invalid_client` on `/auth/token`, `400 unauthorized_client` (grant type not allowed), `400 invalid_grant` (code expired/reused/PKCE mismatch), `400 invalid_redirect_uri` (redirect_uri doesn't exact-match), `404` on `POST /login/google` (PostHog feature flag off — older docs said 403), `429 Too Many Requests` (rate limit), `Max-Age=0` cookies (the ms-vs-seconds bug), missing `Set-Cookie` (forgot `credentials: 'include'`), and CORS failures in prod that worked in dev (`\.overlens\.com\.br$` origin regex). Triggers on phrases like "401 Overlens", "invalid_client Overlens", "CORS error Overlens", "Overlens login works locally but not in production", "429 Overlens rate limit", "Overlens cookie not being set", "Max-Age=0", "redirect_uri_mismatch IDP", "unauthorized_client Overlens", "my Overlens Google login returns 404 (or 403)", or any stuck-on-an-error-code report against the Overlens IDP. This skill diagnoses HTTP/transport/config failures. If instead the token IS received but its CONTENTS look wrong (bad `iss`/`aud`, `kid not found`, signature verify fails, decode the payload, algorithm-confusion, stale JWKS after rotation), prefer `idp-debug-jwt`. If nothing is failing yet and the dev just wants to integrate, prefer the integration skills (`idp-integrate-oauth-web`, `idp-auth-nextjs`, `idp-integrate-m2m`, `idp-validate-token`).