diff --git a/api/src/tv-modules/auth/AuthController.ts b/api/src/tv-modules/auth/AuthController.ts
index cd48489..4f8a4fe 100644
--- a/api/src/tv-modules/auth/AuthController.ts
+++ b/api/src/tv-modules/auth/AuthController.ts
@@ -313,7 +313,7 @@ export default class AuthController {
     loginByCode = async (req: Request, res: Response) => {
         const schema = z.object({
             email: z.string().trim().email().toLowerCase(),
-            code: z.string().trim().regex(/^\d{6}$/, '6-digit code'),
+            code: z.string().trim().min(6).max(64),
         });
 
         const data = schema.safeParse(req.body);
diff --git a/api/src/tv-modules/sso/providers/oidc.provider.ts b/api/src/tv-modules/sso/providers/oidc.provider.ts
index f567cde..88a6d6b 100644
--- a/api/src/tv-modules/sso/providers/oidc.provider.ts
+++ b/api/src/tv-modules/sso/providers/oidc.provider.ts
@@ -114,6 +114,7 @@ export class OidcProvider implements SsoProvider {
     const tokens = await client.authorizationCodeGrant(config, currentUrl, {
       pkceCodeVerifier: codeVerifier,
       expectedState: returnedState,
+      expectedNonce: storedNonce,
     })
 
     const claims = tokens.claims()
@@ -122,10 +123,6 @@ export class OidcProvider implements SsoProvider {
       throw new Error('OIDC token missing email claim')
     }
 
-    if (claims.nonce !== storedNonce) {
-      throw new Error('Nonce mismatch — possible token replay attack')
-    }
-
     return {
       email: (claims.email as string).toLowerCase(),
       externalId: claims.sub,