diff --git a/packages/server/modules/auth/services/apps.js b/packages/server/modules/auth/services/apps.js
index b375f3097..3cee63aa6 100644
--- a/packages/server/modules/auth/services/apps.js
+++ b/packages/server/modules/auth/services/apps.js
@@ -204,6 +204,8 @@ module.exports = {
   },
 
   async createAuthorizationCode({ appId, userId, challenge }) {
+    if (!challenge) throw new Error('Please provide a valid challenge.')
+
     const ac = {
       id: crs({ length: 42 }),
       appId,