OAuth authorize callback not working with state parameter

[Rohan Patil]

I am passing a state parameter to OAuth authorize URL
eg: https://bitbucket.org/site/oauth2/authorize?client_id=LBYaNhkaPmghskxxxx&response_type=code&redirect_uri=https://yyyy.xxxx.com/handle-bitbucket-cloud-consumer-oauth-event&state=installationUid%3D6797c0f45b68131c645axxxx.

The redirect URL becomes:
https://bitbucket-cloud-app-fu.xxxx.com/handle-bitbucket-cloud-consumer-oauth-event?code=XZf3GfxJdbz39yxxxx&state=installationUid%3D6797c0f45b68131c645axxxx 

but I get an error on the server

{ "error_message": "You're not allowed in here unless you're logged in.", "error_code": 105, "errors": { "authtoken": [ "is not valid." ] } }

But if if remove the state parameter the callback works
eg: 

https://bitbucket.org/site/oauth2/authorize?client_id=LBYaNhkaPmghskxxxx&response_type=code&redirect_uri=https://yyyy.xxxx.com/handle-bitbucket-cloud-consumer-oauth-event

[Rohan Patil · Accepted solution]

This is resolved. I was using the wrong API. But I don't understand why Bitbucket has 2 APIs
1. Access Token API URL: https://bitbucket.org/site/oauth2/access_token 

2. API URL (fetch workspace, repositories etc): https://api.bitbucket.org/2.0