{"record":{"id":"2d57d28ed705470a","repo":"mastra-ai/mastra","slug":"okta-redirect-uri-is-required-for-sso-provide-it","errorCode":null,"errorMessage":"Okta redirect URI is required for SSO. Provide it in the options or set OKTA_REDIRECT_URI environment variable.","messagePattern":"Okta redirect URI is required for SSO\\. Provide it in the options or set OKTA_REDIRECT_URI environment variable\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/okta/src/auth-provider.ts","lineNumber":169,"sourceCode":"\n    if (!domain) {\n      throw new Error('Okta domain is required. Provide it in the options or set OKTA_DOMAIN environment variable.');\n    }\n\n    if (!clientId) {\n      throw new Error(\n        'Okta client ID is required. Provide it in the options or set OKTA_CLIENT_ID environment variable.',\n      );\n    }\n\n    if (!clientSecret) {\n      throw new Error(\n        'Okta client secret is required for SSO. Provide it in the options or set OKTA_CLIENT_SECRET environment variable.',\n      );\n    }\n\n    if (!redirectUri) {\n      throw new Error(\n        'Okta redirect URI is required for SSO. Provide it in the options or set OKTA_REDIRECT_URI environment variable.',\n      );\n    }\n\n    if (cookiePassword.length < 32) {\n      throw new Error('Cookie password must be at least 32 characters. Set OKTA_COOKIE_PASSWORD environment variable.');\n    }\n\n    this.domain = domain;\n    this.clientId = clientId;\n    this.clientSecret = clientSecret;\n    // Normalize trailing slashes so a stray `OKTA_ISSUER=https://domain/` doesn't produce `.../oauth2//v1/...`\n    this.issuer = trimTrailingSlashes(issuer ?? `https://${domain}/oauth2/default`);\n    // Org authorization servers use issuer `https://{domain}` but serve endpoints under `/oauth2/v1/*`.\n    // Custom authorization servers use issuer `https://{domain}/oauth2/<name>` and serve endpoints under `<issuer>/v1/*`.\n    // `issuer` is still used verbatim for JWT `iss`-claim validation on both server types.\n    this.endpointBase =\n      this.issuer.includes('/oauth2/') || this.issuer.endsWith('/oauth2') ? this.issuer : `${this.issuer}/oauth2`;","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/okta/src/auth-provider.ts#L151-L187","documentation":"Validation thrown in the OktaAuthProvider constructor when no redirect URI is provided via options.redirectUri or OKTA_REDIRECT_URI. The redirect URI must match a whitelisted URI on the Okta application for the SSO authorization-code flow to work.","triggerScenarios":"new OktaAuthProvider(...) with domain, clientId, clientSecret set but neither options.redirectUri nor OKTA_REDIRECT_URI defined.","commonSituations":"Forgetting to configure the callback URL env var per environment (dev vs prod have different callbacks); Okta app whitelist not including the deployed domain so the var was left unset.","solutions":["Set the OKTA_REDIRECT_URI environment variable (e.g. https://yourapp.com/api/auth/sso/okta/callback).","Pass `redirectUri` explicitly in the constructor options.","Ensure the exact URI is registered as a allowed redirect URI in the Okta application settings.","Use environment-specific values so each deployment points at its own callback."],"exampleFix":"// before\nnew OktaAuthProvider({ domain, clientId, clientSecret });\n// after\nnew OktaAuthProvider({\n  domain,\n  clientId,\n  clientSecret,\n  redirectUri: process.env.OKTA_REDIRECT_URI, // e.g. https://app.example.com/callback\n});","handlingStrategy":"validation","validationCode":"if (!process.env.OKTA_REDIRECT_URI) {\n  throw new Error('Set OKTA_REDIRECT_URI before constructing OktaAuthProvider');\n}\nconst auth = new OktaAuthProvider();","typeGuard":null,"tryCatchPattern":"try {\n  auth = new OktaAuthProvider();\n} catch (e) {\n  if (e instanceof Error && e.message.includes('redirect URI is required')) {\n    throw new Error('Server misconfiguration: OKTA_REDIRECT_URI missing');\n  }\n  throw e;\n}","preventionTips":["Configure one redirect URI per environment and register each in the Okta app.","Keep the callback URL in sync between the authorize request and env config.","Include a startup config check that prints the effective redirect URI in dev."],"tags":["okta","configuration","env-var","sso"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}