OAuth Callback Failures That Kill SDK Onboarding

OAuth is the most common silent killer in SDK onboarding. The popup never returns under Safari ITP. The callback lands forty seconds after the JWT expired. The developer assumes your product is broken and leaves without filing an issue.

Dashboards may show a drop at /oauth/callback. They rarely preserve the exact timing, runtime, and developer note that make the root cause obvious.

Put a probe on the web SDK and the callback endpoint. Capture error codes like JWT_EXPIRED_CALLBACK with the lag between issue and landing. Ask one clarifying question while the session is still open.

That combination turns a vague auth problem into a thread DX can close the same day.

Sometimes the fix is docs. Sometimes it is cookie partitioning guidance. Sometimes it is token lifetime. The point is to hear the failure while it is still on screen, then draft the GitHub issue you still approve.