diff --git a/TODO b/TODO
index 960530c..6c4ee6b 100644
--- a/TODO
+++ b/TODO
@@ -9,4 +9,6 @@
 - 429 lichess error handling
 - add throw errors or return errors in server code
 - try/catch where needed in client code
-- generate state and check it against the state returned from lichess https://lichess.org/api#tag/oauth/GET/oauth
\ No newline at end of file
+- generate state and check it against the state returned from lichess https://lichess.org/api#tag/oauth/GET/oauth
+- checkbox and toggle disabled states
+- 404
\ No newline at end of file
diff --git a/src/pages/Callback.tsx b/src/pages/Callback.tsx
index a3f7fd7..9f06a1b 100644
--- a/src/pages/Callback.tsx
+++ b/src/pages/Callback.tsx
@@ -6,6 +6,8 @@ const routeApi = getRouteApi("/callback");
 const Callback = () => {
 	const { useLichessCallback } = useLichess();
 	const { code } = routeApi.useSearch();
+
+	// TODO deal with error if code is invalid
 	useLichessCallback({ code }).then();
 
 	return <div>Loading...</div>;
diff --git a/src/routes/callback.tsx b/src/routes/callback.tsx
index c54a903..5c9bf96 100644
--- a/src/routes/callback.tsx
+++ b/src/routes/callback.tsx
@@ -1,4 +1,4 @@
-import { createFileRoute } from "@tanstack/react-router";
+import { createFileRoute, notFound } from "@tanstack/react-router";
 import { z } from "zod";
 import Callback from "#/pages/Callback.tsx";
 
@@ -6,10 +6,14 @@ const callbackSchema = z.object({
 	code: z.string(),
 });
 
-// type CallbackProps = z.infer<typeof callbackSchema>;
-
 export const Route = createFileRoute("/callback")({
 	validateSearch: (search) => callbackSchema.parse(search),
+
+	beforeLoad: ({ search }) => {
+		if (!search.code) {
+			throw notFound();
+		}
+	},
 	component: RouteComponent,
 });