ChatGPT answers this very nicely. You could consider to check some of the public AI chats to fix this kind of issues faster.
I’d be interested to know if suggestion 2 works for you.
That’s a classic Meteor + Facebook OAuth issue — and you’re right: it often only happens in mobile browsers or in-app browsers (like Facebook, Instagram, TikTok) .
Let’s break it down clearly 
The error
Failed to complete OAuth handshake with Facebook.
can't find access token in HTTP response. [object Object]
It means:
- Meteor’s OAuth flow successfully redirected to Facebook’s authorization page.
- Facebook redirected back to your callback URL.
- Meteor tried to parse the token response… and didn’t find an access_token field in the JSON body.
So Meteor ends up logging [object Object] because it expected a plain string token, not an unexpected or malformed response.
Why only on mobile browsers?
There are a few very specific mobile-only causes for this:
1.
In-app browsers block 3rd-party cookies
- When users open your app or login page inside Facebook’s or Instagram’s in-app browser, the OAuth session can’t persist between redirects because cookies are blocked or isolated.
- This breaks Meteor’s OAuth handshake state validation (Meteor stores an OAuth request token in a session cookie).
- When the callback returns, Meteor can’t match it to the original request — and the Facebook response parsing fails.
You can confirm this by checking whether the login works if you open the same page in Safari or Chrome on the same mobile.
2.
Redirect URI mismatch due to deep linking / mobile URL
- On mobile, you might be using a slightly different URL (e.g. https://m.example.com or Example Domain) or Meteor may rewrite the redirect URI with a fragment/hash that Facebook doesn’t expect.
- Facebook will then respond with an HTML error page instead of a JSON token, and Meteor tries to parse that as JSON — hence [object Object].
Check your Facebook App → Settings → Valid OAuth Redirect URIs
Make sure it includes all variants:
https://example.com/_oauth/facebook
https://www.example.com/_oauth/facebook
https://m.example.com/_oauth/facebook
3.
Facebook returning an error payload
Sometimes the “object” is actually this:
{
"error": {
"message": "Missing redirect_uri parameter.",
"type": "OAuthException",
"code": 191
}
}
Meteor logs it as [object Object], losing the details.
To debug this properly, log the full err.response in your server console.
Example patch:
Accounts.onLoginFailure((info) => {
console.error('OAuth failure details:', info);
});
Or if using a custom login handler, log response.data before Meteor parses it.
4.
HTTPS vs HTTP
Mobile browsers (especially Safari) enforce stricter redirect security:
- If your redirect is HTTP, or mismatched (like port numbers), Safari may block or rewrite it silently.
- This causes the OAuth flow to fail silently.
Make sure your entire flow is HTTPS-only with canonical domain names.
5.
Popup vs Redirect flow
Meteor’s OAuth uses a popup in desktop browsers but sometimes falls back to redirect on mobile (because popups are blocked).
The redirect flow behaves differently — it depends entirely on cookies and precise redirect URIs.
So even if the popup flow works on desktop, the redirect version can fail on mobile if cookies or redirects aren’t handled properly.
Fix summary
| Problem |
Fix |
| In-app browser blocking cookies |
Add a “Open in browser” link or detect in-app browsers and warn users |
| Redirect URI mismatch |
Add all mobile/desktop variants in Facebook App settings |
| JSON parsing error |
Log full response to see real payload |
| HTTPS or domain mismatch |
Force HTTPS and single canonical domain |
| Mobile redirect flow issues |
Consider using redirectUri explicitly in your OAuth configuration |
If you paste the exact redirect URI and Facebook app settings (minus secrets), I can tell you precisely which mismatch is triggering this.
Would you like to do that?