BOSSTORQUE Internal — Ops Reference

Quicken + Mercury — HTTP 400 on OAuth Reconnect

First seen: prior recurrence, multiple times Confirmed fix: May 13, 2026 Owner: Jason

Symptom

Reconnecting the Mercury account inside Quicken kicks the browser out to:

https://services.quicken.com/oauth-redirect/<long-id>...

HTTP Status 400 — Bad Request
Blank page below the error banner. No way to retry from the failed tab. The Quicken dialog still shows the connection as pending or unauthenticated.

Hits the connection flow whether triggered from "Set Up Now" on a new account or "Reactivate" on a previously connected one.

Root Cause

Stale OAuth state in the browser. The handshake between Quicken Connection Services (QCS) and Mercury depends on a short-lived state cookie/token. If anything stretches the time between Mercury approving and Quicken's callback receiving the response — slow click, second auth window, prior failed attempt leaving residue — the state token expires or doesn't match, and QCS rejects the callback with a 400.

The 400 is not from Mercury and not from Quicken's desktop client. It's from services.quicken.com rejecting the callback because the inbound state doesn't match what QCS expects.

The Fix

Run these steps in order. Each one matters — skipping the cookie clear or the deactivate step usually causes the next attempt to fail the same way.

1. Close the failed flow

Close the 400 browser tab and the Quicken connection dialog. Do not retry from the failed tab — the broken state will carry forward.

2. Pre-authenticate Mercury

In a fresh browser tab, log into app.mercury.com. Confirm you're signed in before going back to Quicken.

3. Clear the stale state

Clear cookies for services.quicken.com and mercury.com, or open a fresh Incognito/Private window for the retry. This is the step that actually fixes the 400 — without it, the cached state keeps poisoning the handshake.

4. Deactivate the account in Quicken

In Quicken: Accounts → [Mercury account] → Settings (gear) → Online Services → Deactivate. Confirm the account drops to manual. This wipes Quicken's side of the broken connection.

5. Reactivate

On the same account, click Set Up Now / Activate. When the browser handoff fires, you're already logged into Mercury, so the OAuth approval is a single click and the callback completes cleanly.

Confirmed working: May 13, 2026. Reconnection succeeded on the first attempt after running this sequence.

If the 400 Returns After the Fix

Two known fallbacks:

Try a different browser. Quicken's OAuth flow can choke on Chrome's third-party cookie blocking. Safari, Firefox, or an Incognito window with cookies enabled often clears it.
Check QCS status. status.quicken.com — Mercury via QCS has had intermittent outages multiple times this year. If QCS is degraded, no client-side fix will work until they recover.

Last-Resort Workaround

Manual import via Web Connect. Mercury → Settings → API tokens → generate a token. In Quicken, set the account type to Web Connect. Then download transactions as QFX or CSV directly from Mercury and import manually. Less elegant, but completely independent of QCS.

Useful when QCS is broken for days and you need to keep the books current.

Related Tasks

mercury-cashflow-watch — paused May 13 when the Mercury MCP failed. Re-enable after the Quicken reconnect AND Mercury MCP re-auth in Cowork Customize.
mercury-credit-sync — same status. Re-enable in tandem.
Quicken nightly — runs at 2 AM PT. First successful run after reconnect confirms Quicken-side health.

What to Watch

This is a recurring failure mode, not a one-time issue. Mercury–QCS has been fragile through 2026. Triggers seen so far:

Mercury token expiry / forced re-auth from Mercury's side
Quicken auto-update touching the OAuth client config
Browser updates changing third-party cookie behavior (Chrome especially)
QCS-side intermittent outages

When the next 400 hits, this runbook is the first move. Don't bother debugging — clear state, reactivate, retry.