Thanks, I can reproduce under certain conditions, I think I can see what is happening.
When a user starts an authentication from meta, we store a value for destination_url on the ID instance so that after authentication, the user can be taken back to where they were. But when the authentication isn’t completed within a short amount of time (it fails or user abandons auth), that destination_url is not cleaned up, it stays in the user’s browser session. The next time the user tries to log in, ID tries to redirect to that URL, but since it has an old code/state combination from the original auth flow, the redirect results in the “Sorry, the authorization timed out” error.
It should not redirect at all after a short amount of time, we need to make sure that the destination_url value gets cleaned up after 10 mins, I believe the code/state combo for authentication is only valid for 10 minutes, need to double check.