{"record":{"id":"403b53a292d22001","repo":"paperclipai/paperclip","slug":"better-auth-secret-or-paperclip-agent-jwt-secret","errorCode":null,"errorMessage":"BETTER_AUTH_SECRET (or PAPERCLIP_AGENT_JWT_SECRET) must be set. For local development, set BETTER_AUTH_SECRET=paperclip-dev-secret in your .env file.","messagePattern":"BETTER_AUTH_SECRET \\(or PAPERCLIP_AGENT_JWT_SECRET\\) must be set\\. For local development, set BETTER_AUTH_SECRET=paperclip-dev-secret in your \\.env file\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/src/auth/better-auth.ts","lineNumber":190,"sourceCode":"    normalizeWorkspaceHandoffOrigin(env.PAPERCLIP_PUBLIC_URL)\n    ?? (config.authBaseUrlMode === \"explicit\"\n      ? normalizeWorkspaceHandoffOrigin(config.authPublicBaseUrl)\n      : null);\n  return {\n    key,\n    instanceId: resolvePaperclipInstanceId(),\n    executionWorkspaceId: resolveWorkspaceHandoffLocalWorkspaceId(env),\n    companyId: resolveWorkspaceHandoffLocalCompanyId(env),\n    origin: configuredOrigin,\n  };\n}\n\nexport function createBetterAuthInstance(db: Db, config: Config, trustedOrigins: string[]): BetterAuthInstance {\n  const baseUrl = config.authBaseUrlMode === \"explicit\" ? config.authPublicBaseUrl : undefined;\n  const publicUrl = process.env.PAPERCLIP_PUBLIC_URL?.trim() || baseUrl;\n  const secret = process.env.BETTER_AUTH_SECRET ?? process.env.PAPERCLIP_AGENT_JWT_SECRET;\n  if (!secret) {\n    throw new Error(\n      \"BETTER_AUTH_SECRET (or PAPERCLIP_AGENT_JWT_SECRET) must be set. \" +\n      \"For local development, set BETTER_AUTH_SECRET=paperclip-dev-secret in your .env file.\",\n    );\n  }\n  const disableSecureCookies = shouldDisableSecureAuthCookies({\n    deploymentMode: config.deploymentMode,\n    deploymentExposure: config.deploymentExposure,\n    authBaseUrlMode: config.authBaseUrlMode,\n    authPublicBaseUrl: config.authPublicBaseUrl,\n    publicUrl,\n  });\n\n  const authConfig = {\n    baseURL: baseUrl,\n    secret,\n    trustedOrigins,\n    database: drizzleAdapter(db, {\n      provider: \"pg\",","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/auth/better-auth.ts#L172-L208","documentation":"Startup secret validation when creating the better-auth instance: neither BETTER_AUTH_SECRET nor its fallback PAPERCLIP_AGENT_JWT_SECRET is set. Auth token signing is impossible without a secret; in authenticated deployments this is a hard failure at boot. For local development set BETTER_AUTH_SECRET=paperclip-dev-secret in .env.","triggerScenarios":"Thrown at server/src/auth/better-auth.ts:152 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set BETTER_AUTH_SECRET in your environment (for local dev: BETTER_AUTH_SECRET=paperclip-dev-secret in .env).","Alternatively set PAPERCLIP_AGENT_JWT_SECRET."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}