{"record":{"id":"593e8dfc67433f41","repo":"medusajs/medusa","slug":"oidc-engine-requires-a-callback-url-option","errorCode":null,"errorMessage":"OIDC engine requires a 'callback_url' option","messagePattern":"OIDC engine requires a 'callback_url' option","errorType":"validation","errorClass":"MedusaError","httpStatus":400,"severity":"critical","filePath":"packages/modules/providers/auth-oidc/src/engine/engine.ts","lineNumber":77,"sourceCode":"   */\n  protected clientPromise_?: Promise<Client>\n  protected clientExpiresAt_ = 0\n\n  constructor(options: OidcEngineOptions, cache?: ICacheService) {\n    if (!options?.issuer) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"OIDC engine requires an 'issuer' option\"\n      )\n    }\n    if (!options.client_id) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"OIDC engine requires a 'client_id' option\"\n      )\n    }\n    if (!options.callback_url) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"OIDC engine requires a 'callback_url' option\"\n      )\n    }\n\n    assertSecureUrl(options.issuer, \"issuer\")\n    for (const [key, value] of [\n      [\"authorization_endpoint\", options.authorization_endpoint],\n      [\"token_endpoint\", options.token_endpoint],\n      [\"jwks_uri\", options.jwks_uri],\n    ] as const) {\n      if (value) {\n        assertSecureUrl(value, key)\n      }\n    }\n\n    this.options_ = options\n    this.discoveryCacheTtlMs_ =","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/providers/auth-oidc/src/engine/engine.ts#L59-L95","documentation":"The OIDC auth provider engine was constructed without a callback_url option. The engine needs the URL that the identity provider redirects back to after login, both to build the authorization URL and to validate the callback, so it refuses to initialize when it is missing.","triggerScenarios":"Instantiating the OidcEngine (or the auth-oidc provider module) with an options object that omits callback_url, e.g. only passing issuer and client_id.","commonSituations":"medusa-config.js defines an authProvider entry for oidc but forgot the callback_url key; the value was read from an env var that is undefined in the current environment; copy-paste from another provider config that used a different key name (e.g. redirect_uri).","solutions":["Add callback_url to the provider options in medusa-config.js, set to your Medusa callback route (e.g. https://<host>/auth/customer/<strategy>/callback or the admin callback route).","If the value comes from an env var, verify it is set in .env and that the process was restarted after adding it.","Ensure the same URL is registered in the identity provider's allowed redirect/callback URLs."],"exampleFix":"// before\nauthProviders: [\n  { resolve: \"@medusajs/auth-oidc\", id: \"google\", options: { issuer: \"...\", client_id: \"...\" } },\n]\n// after\nauthProviders: [\n  { resolve: \"@medusajs/auth-oidc\", id: \"google\", options: { issuer: \"...\", client_id: \"...\", callback_url: process.env.GOOGLE_CALLBACK_URL } },\n]","handlingStrategy":"validation","validationCode":"const opts = providerConfig.options ?? {}\nif (!opts.callback_url) {\n  throw new Error(\"OIDC provider 'google' is missing options.callback_url\")\n}","typeGuard":"const hasCallbackUrl = (o: Partial<OidcAuthProviderOptions>): o is OidcAuthProviderOptions =>\n  typeof o.callback_url === \"string\" && o.callback_url.length > 0","tryCatchPattern":"try { new OidcEngine(options) } catch (e) { if (e instanceof MedusaError && e.type === MedusaError.Types.INVALID_DATA) { /* fail fast with config guidance */ } throw e }","preventionTips":["Fail fast at boot: validate required OIDC options (issuer, client_id, callback_url) in a startup check with clear messages.","Source all OIDC config from env vars and add them to deployment checklists.","Add a config smoke test that loads medula-config.js in CI."],"tags":["oidc","configuration","auth-provider","startup"],"backgroundTag":"missing-config-option","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}