diff --git a/dashboard/src/guest.rs b/dashboard/src/guest.rs
index e99f2c3e7c24e22ceb78be0d09d2827571908fd1..3a4afe262d54be21d7e096c0a116d3d6ea9ee884 100644
--- a/dashboard/src/guest.rs
+++ b/dashboard/src/guest.rs
@@ -325,9 +325,12 @@ async fn exchange(
             })?;
         return Ok((id.to_string(), login.to_owned()));
     }
+    let mut form = form.to_vec();
+    form.push(("state", "none"));
     let token = json_bytes(
         &response_bytes(
             http.post(format!("{ASTHENO}/api/token"))
+                .basic_auth(client, Some(secret))
                 .form(&form)
                 .send()
                 .await?,
@@ -557,8 +560,17 @@ async fn handle(app: &App, request: Request) -> Result<Response> {
                 headers
             })
             .build()?;
-        let (subject, name) =
-            exchange(&http, provider, &client, &secret, code, &callback, &flow).await?;
+        let (subject, name) = exchange(&http, provider, &client, &secret, code, &callback, &flow)
+            .await
+            .map_err(|error| {
+                eprintln!(
+                    "guest rejected code: {provider} length {} whitespace {} dots {}",
+                    code.len(),
+                    code.bytes().any(|c| c.is_ascii_whitespace()),
+                    code.bytes().filter(|c| *c == b'.').count()
+                );
+                error
+            })?;
         let id = account(auth, provider, &subject, &name)?;
         auth.create_session(&id, "dashboard", headers, None)
     }