{"record":{"id":"60de8c8d1d92016c","repo":"mastra-ai/mastra","slug":"redirect-uri-is-required-for-sso-set-auth0-redire","errorCode":null,"errorMessage":"Redirect URI is required for SSO. Set AUTH0_REDIRECT_URI or pass redirectUri option.","messagePattern":"Redirect URI is required for SSO\\. Set AUTH0_REDIRECT_URI or pass redirectUri option\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/auth0/src/index.ts","lineNumber":506,"sourceCode":"      return null; // Invalid/corrupt cookie\n    }\n  }\n\n  // ============================================================================\n  // Dynamic ISSOProvider attachment (only when OAuth is configured)\n  // ============================================================================\n\n  /**\n   * Dynamically attach ISSOProvider methods to this instance.\n   * This ensures duck-typing detection only finds these methods when SSO is configured.\n   */\n  private _attachSSOProvider() {\n    const self = this;\n\n    (this as unknown as ISSOProvider<EEUser>).getLoginUrl = function (redirectUri: string, state: string): string {\n      const actualRedirectUri = redirectUri ?? self._redirectUri;\n      if (!actualRedirectUri) {\n        throw new Error('Redirect URI is required for SSO. Set AUTH0_REDIRECT_URI or pass redirectUri option.');\n      }\n\n      // Create a signed state token that encodes redirectUri (stateless, works in serverless/multi-instance)\n      const signedState = createStateToken(state, actualRedirectUri, self.cookiePassword);\n\n      const params = new URLSearchParams({\n        client_id: self.clientId!,\n        response_type: 'code',\n        scope: self.scopes.join(' '),\n        redirect_uri: actualRedirectUri,\n        state: signedState,\n      });\n\n      return `https://${self.domain}/authorize?${params.toString()}`;\n    };\n\n    (this as unknown as ISSOProvider<EEUser>).handleCallback = async function (\n      code: string,","sourceCodeStart":488,"sourceCodeEnd":524,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/auth0/src/index.ts#L488-L524","documentation":"The SSO provider's getLoginUrl builds the Auth0 authorization URL and needs a redirect URI for the OAuth callback. It first uses the redirectUri argument, falling back to the instance's configured _redirectUri (from AUTH0_REDIRECT_URI or the redirectUri option). This error is thrown when both are empty, meaning no callback URL is available to include in the login URL.","triggerScenarios":"Calling getLoginUrl(redirectUri, state) with undefined/null redirectUri while the provider was constructed without a redirectUri option and without AUTH0_REDIRECT_URI set in the environment.","commonSituations":"Deploying without AUTH0_REDIRECT_URI in env vars; calling getLoginUrl programmatically and passing undefined for the redirect param; forgetting the option when constructing the provider in a new service; the callback URL not matching what's registered in the Auth0 application settings.","solutions":["Set AUTH0_REDIRECT_URI (e.g. https://yourapp.com/api/auth/callback) in the environment","Pass redirectUri in the provider constructor options: new AuthOServerAuth({ ..., redirectUri: 'https://...' })","Pass a non-empty redirectUri argument directly to getLoginUrl(url, state)","Verify the URI is also registered in the Auth0 application's Allowed Callback URLs"],"exampleFix":"// before\nconst url = provider.getLoginUrl(undefined, state);\n// after\nconst url = provider.getLoginUrl('https://myapp.com/api/auth/callback', state);\n// or better, configure once:\nnew AuthOServerAuth({ redirectUri: 'https://myapp.com/api/auth/callback', ... });","handlingStrategy":"validation","validationCode":"const redirectUri =\n  explicitRedirectUri ?? process.env.AUTH0_REDIRECT_URI ?? configuredOption?.redirectUri;\nif (!redirectUri) {\n  throw new Error('Set AUTH0_REDIRECT_URI or pass redirectUri option before calling getLoginUrl');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const url = provider.getLoginUrl(redirectUri, state);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Redirect URI is required for SSO')) {\n    throw new Error('SSO login URL cannot be built: configure AUTH0_REDIRECT_URI or the redirectUri option', { cause: e });\n  }\n  throw e;\n}","preventionTips":["Always set AUTH0_REDIRECT_URI in every environment (dev, staging, prod)","Register the exact callback URL in the Auth0 application's Allowed Callback URLs","Never pass undefined/empty redirectUri to getLoginUrl","Validate presence of redirectUri during app startup config checks"],"tags":["auth0","sso","oauth","missing-config","redirect-uri"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}