Error enriching token

We’re getting “Error enriching token” on login for one of our Okta groups. All our other groups work with their apps except for this one. Any idea what might be causing that?

We also noticed that the url for the affected users contains a state parameter (followed by the error) instead of code parameter.

did you check Okta system log for any suspicious events?

I had a look, but didn’t see anything that sticks out. What kind of events might be related to that error?

do you have any token inline hooks configured?