Box Drive for Mac login loop: token exchange returns pkce_verification_failed

Environment: macOS 27.0.1 (build 26A434), Apple Silicon. Box Drive 2.54.172 at first, then 2.55.132 after a clean reinstall. No proxy.

Symptom: The browser login works and the redirect back to boxdrive://oauth2_redirect arrives with the matching state. Box Drive’s call to POST https://api.box.com/oauth2/token then fails with {'error': 'pkce_verification_failed'}. The app shows UNKNOWN_OAUTH_FAILURE and goes back to the login screen.

How often: Every attempt (9 in total, Oct 13–19), including the first one after a fresh launch. Tried with Safari and Chrome.

Already tried:

• Reset with Box’s own uninstall_box_drive script
• Fresh install of 2.55.132 from e3.boxcdn.net (signed and notarized)
• Allowed Box Helper in Login Items

Request IDs:

• 0b6ad7cc9bc66f9fa5779d14e12af226a: 2026-10-19 12:55:54 IST, v2.55.132
• 1500093265dc46580cc1b816db9536c42: 2026-10-19 12:02:10 IST, v2.54.172
• 068b66bfe2f2365a28ee5e8f0e67bd1a1: 2026-10-13 19:09:13 IST, v2.54.172