anomalyco/sst · error · Error

Auth: issuer field must be set

Error message

Auth: issuer field must be set

What it means

The Auth component's `createIssuer` builds the issuer function used to authenticate requests. It requires either `args.authorizer` or `args.issuer` to be set; if neither is provided there is no way to construct the auth handler, so it throws immediately. This is a developer configuration error caught at definition time.

Source

Thrown at platform/src/components/aws/auth.ts:314

        _hint: self.url,
      });
    }

    function createTable() {
      return new Dynamo(
        `${name}Storage`,
        {
          fields: { pk: "string", sk: "string" },
          primaryIndex: { hashKey: "pk", rangeKey: "sk" },
          ttl: "expiry",
        },
        { parent: self },
      );
    }

    function createIssuer() {
      const fn = args.authorizer || args.issuer;
      if (!fn) throw new Error("Auth: issuer field must be set");
      return functionBuilder(
        `${name}Issuer`,
        fn,
        {
          link: [table],
          environment: {
            OPENAUTH_STORAGE: jsonStringify({
              type: "dynamo",
              options: { table: table.name },
            }),
          },
          _skipHint: true,
        },
        (args) => {
          args.url = {
            ...(typeof args.url === "object" ? args.url : {}),
            cors: false,
          };

View on GitHub (pinned to a0bd20f762)

Solutions

1. Add an `issuer` function to the Auth args that returns a session payload
2. Pass an `authorizer` function instead if you need full control over authentication
3. Check for typos in the args key names (`issuer`/`authorizer`)

Example fix

// before
const auth = new sst.aws.Auth("Auth", {});
// after
const auth = new sst.aws.Auth("Auth", {
  issuer: {
    handler: "src/auth/issuer.handler",
  },
});

const authArgs = { issuer: { handler: "src/auth/issuer.handler" } };
if (!authArgs.issuer && !authArgs.authorizer) {
  throw new Error("Auth requires issuer or authorizer");
}
new sst.aws.Auth("Auth", authArgs);

function hasAuthTarget(a: { issuer?: unknown; authorizer?: unknown }): a is { issuer: NonNullable<unknown> } & typeof a {
  return Boolean(a.issuer || a.authorizer);
}

try {
  const auth = new sst.aws.Auth("Auth", args);
} catch (e) {
  if ((e as Error).message.includes("issuer field must be set")) {
    throw new Error("Add issuer or authorizer to Auth args");
  }
  throw e;
}

When it happens

Trigger: Creating `new sst.aws.Auth(...)` without passing either `issuer` or `authorizer` in the args object.

Common situations: Forgotten `issuer` callback after refactoring auth config; copying a boilerplate Auth component without filling in the issuer function; typo'd property name (e.g. `issuers` instead of `issuer`).

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• At least one of function, queue, or topic is required for th
• Function URL is not enabled. Enable it with "url: true".
• You must provide the password to connect to your locally run
• Reader endpoint is not currently supported for RDS Proxy. Pl
• Only one of function, queue, or topic is allowed for the "${

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/9f7cba82eeb3bffb. Report an issue: GitHub.