Invalid code verifier error during OIDC token exchange with Pocket-ID (PKCE)

[QVBU]

Failed to exchange token: oauth2: "Invalid code verifier", POST /api/oidc/token returns 400
Authorization on the Pocket-ID side completes successfully (code is issued), but Gokapi fails to exchange the authorization code for an access token. According to nginx logs, the server issues a POST /api/oidc/token request to the provider which responds with HTTP 400.

Nginx access log showing the outgoing token request:
172.19.20.10 - d35fg61b-247a-48d1-a3j5-35e85673672p [21/Oct/2025:14:38:51 +0200] "POST /api/oidc/token HTTP/2.0" 400 33 "-" "Go-http-client/2.0"

OAuth callback received by Gokapi:
GET https://api.example.com/oauth-callback?code=vRjdjjfuJhdHGidvR&state=kjdsjh875hG4&iss=https%3A%2F%2Fid.example.com
Response: 303 See Other redirecting to /error-oauth with error "Invalid code verifier"

Observed endpoints during auth flow (chrome network tab):
/api/oidc/authorization-required /api/oidc/authorize /api/webauthn/login/finish /api/webauthn/reauthenticate
However, nginx logs confirm the POST /api/oidc/token request is made by the backend and returns 400.

Could someone confirm whether Gokapi supports PKCE and how the code_verifier is handled across the redirect?
Any pointers on how to fix or work around this issue would also help.
Thanks for help.