{"record":{"id":"4e5bf8e8fcdbecd3","repo":"nextauthjs/next-auth","slug":"name-cookie-was-created-for-a-different-provide","errorCode":null,"errorMessage":"${name} cookie was created for a different provider than the one handling the callback","messagePattern":"(.+?) cookie was created for a different provider than the one handling the callback","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/oauth/checks.ts","lineNumber":78,"sourceCode":"  name: keyof CookiesOptions,\n  value: string | undefined,\n  options: InternalOptions\n): Promise<string> {\n  try {\n    const { logger, cookies, jwt } = options\n    logger.debug(`PARSE_${name.toUpperCase()}`, { cookie: value })\n\n    if (!value) throw new InvalidCheck(`${name} cookie was missing`)\n    const parsed = await decode<CookiePayload>({\n      ...jwt,\n      token: value,\n      salt: cookies[name].name,\n    })\n    if (!parsed?.value) throw new Error(\"Invalid cookie\")\n    // The check must have been created by the provider currently handling\n    // the callback.\n    if (parsed.provider !== options.provider?.id) {\n      throw new Error(\n        `${name} cookie was created for a different provider than the one handling the callback`\n      )\n    }\n    return parsed.value\n  } catch (error) {\n    throw new InvalidCheck(`${name} value could not be parsed`, {\n      cause: error,\n    })\n  }\n}\n\nfunction clearCookie(\n  name: keyof CookiesOptions,\n  options: InternalOptions,\n  resCookies: Cookie[]\n) {\n  const { logger, cookies } = options\n  const cookie = cookies[name]","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/oauth/checks.ts#L60-L96","documentation":"parseCookie throws this error when the decoded cookie payload's `provider` field doesn't match the `options.provider.id` currently handling the callback — a safety check ensuring the state/PKCE check was created for this exact provider. Prevents cross-provider check replay.","triggerScenarios":"A state cookie generated while starting sign-in with provider A is submitted to the callback of provider B; e.g. two OAuth providers with overlapping callback routes, or the provider id in config changed between flow start and callback.","commonSituations":"Multiple providers sharing one callback path and the app initiating sign-in with the wrong provider; renaming a provider id (e.g. \"google\" to \"google-workspace\") while users had in-flight flows; manually crafted signin URLs pointing at a different provider than the one that set the cookie.","solutions":["Start the sign-in flow fresh with the intended provider; don't reuse old authorization URLs across providers.","If you renamed a provider id, redeploy and have users retry sign-in — old cookies are intentionally invalid.","Verify each provider's callback route maps to the correct provider and that signin links specify the right provider id."],"exampleFix":"// before: renamed provider breaks in-flight flows\nproviders: [Google({ id: \"google-workspace\" })]\n// after: keep the provider id stable\nproviders: [Google({ id: \"google\" })]","handlingStrategy":"try-catch","validationCode":"// ensure the signin link's provider matches the callback route being hit\nconst requested = new URL(signinUrl).pathname.split(\"/\").pop()\nif (requested !== providerConfig.id) console.warn(\"Provider id mismatch in signin URL\")","typeGuard":null,"tryCatchPattern":"try {\n  await signIn(providerId)\n} catch (e) {\n  if (e?.message?.includes(\"different provider\")) {\n    // start a fresh sign-in with the intended provider\n  }\n}","preventionTips":["Keep provider ids stable across deploys","Generate signin links programmatically from the provider id, never hardcode","Give each provider a distinct callback route derived from its id"],"tags":["oauth","cookies","state-validation","provider-mismatch"],"backgroundTag":"oauth-state-provider-mismatch","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}