{"record":{"id":"5fdf6dbf4bcc5d54","repo":"mastra-ai/mastra","slug":"workos-api-key-and-client-id-are-required-provide-5fdf6d","errorCode":null,"errorMessage":"WorkOS API key and client ID are required. Provide them in the options or set WORKOS_API_KEY and WORKOS_CLIENT_ID environment variables.","messagePattern":"WorkOS API key and client ID are required\\. Provide them in the options or set WORKOS_API_KEY and WORKOS_CLIENT_ID environment variables\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/workos/src/rbac-provider.ts","lineNumber":85,"sourceCode":"   * Expose roleMapping for middleware access.\n   * This allows the authorization middleware to resolve permissions\n   * without needing to call the async methods.\n   */\n  get roleMapping(): RoleMapping {\n    return this.options.roleMapping;\n  }\n\n  /**\n   * Create a new WorkOS RBAC provider.\n   *\n   * @param options - RBAC configuration options\n   */\n  constructor(options: MastraRBACWorkosOptions) {\n    const apiKey = options.apiKey ?? process.env.WORKOS_API_KEY;\n    const clientId = options.clientId ?? process.env.WORKOS_CLIENT_ID;\n\n    if (!apiKey || !clientId) {\n      throw new Error(\n        'WorkOS API key and client ID are required. ' +\n          'Provide them in the options or set WORKOS_API_KEY and WORKOS_CLIENT_ID environment variables.',\n      );\n    }\n\n    this.workos = new WorkOS(apiKey, { clientId });\n    this.options = options;\n\n    // Initialize LRU cache with configurable size and TTL\n    this.rolesCache = new LRUCache<string, Promise<string[]>>({\n      max: options.cache?.maxSize ?? DEFAULT_CACHE_MAX_SIZE,\n      ttl: options.cache?.ttlMs ?? DEFAULT_CACHE_TTL_MS,\n    });\n  }\n\n  /**\n   * Get all roles for a user from their WorkOS organization memberships.\n   *","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/workos/src/rbac-provider.ts#L67-L103","documentation":"The WorkOS RBAC provider builds its own WorkOS SDK client and therefore needs the same API key and client ID as the auth provider. Resolved from options.apiKey/options.clientId or WORKOS_API_KEY / WORKOS_CLIENT_ID; missing values throw at construction.","triggerScenarios":"`new MastraRBACWorkos(options)` where options.apiKey or options.clientId is undefined and the corresponding env vars are unset or empty.","commonSituations":"RBAC provider added later than the auth provider so env wiring was forgotten; options typed for a different provider (copy-paste from Okta RBAC config); env vars present but scoped to the wrong deployment environment.","solutions":["Set both WORKOS_API_KEY and WORKOS_CLIENT_ID in the environment","Pass them explicitly: new MastraRBACWorkos({ apiKey: '...', clientId: '...' })","Reuse the same values as MastraAuthWorkos — both providers need identical credentials","Check you instantiated the right class with the right options type (MastraRBACWorkosOptions, not the auth options)"],"exampleFix":"// before\nconst rbac = new MastraRBACWorkos({});\n// after\nconst rbac = new MastraRBACWorkos({\n  apiKey: process.env.WORKOS_API_KEY,\n  clientId: process.env.WORKOS_CLIENT_ID,\n});","handlingStrategy":"validation","validationCode":"function assertWorkosRbacConfig(opts) {\n  const apiKey = opts?.apiKey ?? process.env.WORKOS_API_KEY;\n  const clientId = opts?.clientId ?? process.env.WORKOS_CLIENT_ID;\n  if (!apiKey || !clientId) {\n    throw new Error('WorkOS RBAC missing credentials: set WORKOS_API_KEY and WORKOS_CLIENT_ID');\n  }\n  return { apiKey, clientId };\n}","typeGuard":"function hasWorkosRbacOptions(o) {\n  return typeof o === 'object' && o !== null &&\n    typeof o.apiKey === 'string' && o.apiKey.length > 0 &&\n    typeof o.clientId === 'string' && o.clientId.length > 0;\n}","tryCatchPattern":"try {\n  rbac = new MastraRBACWorkos(options);\n} catch (e) {\n  if (e.message.includes('WorkOS API key and client ID')) {\n    throw new ConfigError('WorkOS RBAC needs WORKOS_API_KEY and WORKOS_CLIENT_ID (same as auth provider)');\n  }\n  throw e;\n}","preventionTips":["Share one credentials-loading helper between MastraAuthWorkos and MastraRBACWorkos","Validate WORKOS_* vars once at startup for all WorkOS-based providers","Check option key names against MastraRBACWorkosOptions when copy-pasting config","Add both vars to CI config smoke tests for every WorkOS-enabled environment"],"tags":["config","env-var","workos","rbac","constructor"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}