diff --git a/oauth3.browser.js b/oauth3.browser.js
index 77f8a2b..4875588 100644
--- a/oauth3.browser.js
+++ b/oauth3.browser.js
@@ -112,9 +112,9 @@
         var tok;
 
         function cleanup() {
-          delete window['--oauth3-callback-' + state];
           clearTimeout(tok);
           tok = null;
+          delete window['--oauth3-callback-' + state];
           // this is last in case the window self-closes synchronously
           // (should never happen, but that's a negotiable implementation detail)
           if (!opts.reuseWindow) {