This happens when the app tries to call /answerSecurityQuestion twice or more. Make sure you only answer security question once, after you have received a successful response from calling /authenticate and "status" is "INFORMATION_NEEDED". Also, this sometimes happens when the srv in the request param for /authenticate doesn't match with the one in /answerSecurityQuestion
Another invalid state error can happen when the app call /placeOrder with the same orderId more than once. Please note that an orderId can only be used once. If you want to place the same order again, make sure you preview the order first.