you need to store the State parameter from ChatGPT to send it back to verify that the return is from the original actor:

https://auth0.com/docs/secure/attack-protection/state-parameters#set-and-compare-state-parameter-values

The state parameter will come on the /login call from chatgpt.

You may use that state parameter when calling google, there is really no downside to this. Since your code never sets the state before redirecting to google, google doesnt send back the state, so when you are reading the parameter it comes out as nothing, thus the error from chatgpt.