{"record":{"id":"6ae17daefc835234","repo":"nextauthjs/next-auth","slug":"callback-route-called-without-provider","errorCode":null,"errorMessage":"Callback route called without provider","messagePattern":"Callback route called without provider","errorType":"exception","errorClass":"InvalidProvider","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/index.ts","lineNumber":40,"sourceCode":"  ResponseInternal,\n  User,\n} from \"../../../types.js\"\nimport type { Cookie, SessionStore } from \"../../utils/cookie.js\"\nimport {\n  assertInternalOptionsWebAuthn,\n  verifyAuthenticate,\n  verifyRegister,\n} from \"../../utils/webauthn-utils.js\"\n\n/** Handle callbacks from login services */\nexport async function callback(\n  request: RequestInternal,\n  options: InternalOptions,\n  sessionStore: SessionStore,\n  cookies: Cookie[]\n): Promise<ResponseInternal> {\n  if (!options.provider)\n    throw new InvalidProvider(\"Callback route called without provider\")\n  const { query, body, method, headers } = request\n  const {\n    provider,\n    adapter,\n    url,\n    callbackUrl,\n    pages,\n    jwt,\n    events,\n    callbacks,\n    session: { strategy: sessionStrategy, maxAge: sessionMaxAge },\n    logger,\n  } = options\n\n  const useJwtSession = sessionStrategy === \"jwt\"\n\n  try {\n    if (provider.type === \"oauth\" || provider.type === \"oidc\") {","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/index.ts#L22-L58","documentation":"The callback route (/api/auth/callback/...) requires that the provider was resolved from the URL and matched a configured provider. If options.provider is undefined — the provider segment is missing or does not correspond to any configured provider — InvalidProvider is thrown at callback/index.ts:40.","triggerScenarios":"Hitting /api/auth/callback without a provider segment; a typo in the provider id in the URL (e.g. /callback/googel); the provider was removed from the providers array but old sign-in links still reference it; custom route handlers that invoke the internal callback action without provider context.","commonSituations":"Misconfigured reverse proxy rewriting the callback path; renaming a provider id but forgetting to update the callback URL registered at the IdP; multiple auth entry points where one does not pass the same providers list.","solutions":["Ensure the callback URL includes the provider id and that a provider with exactly that id is in the providers array.","Update the callback/redirect URI registered at the OAuth provider to match your route (/api/auth/callback/<provider>).","Check for URL typos and proxy/rewrite rules that strip the provider segment.","If you renamed a provider, keep the old id as an alias or update all sign-in links."],"exampleFix":"// before\nproviders: [GitHub] // id changed to 'github-enterprise'\n// old links point to /api/auth/callback/github\n// after\nproviders: [GitHub({ id: 'github' })] // keep id stable or update links/redirect URIs","handlingStrategy":"validation","validationCode":"const configuredIds = providers.map(p => 'id' in p ? p.id : p.prototype?.id)\nif (!configuredIds.includes(providerParam)) {\n  throw new Error(`Provider '${providerParam}' is not configured`)\n}","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch(callbackUrl)\n} catch (e) {\n  // InvalidProvider surfaces as a 500 on the route; check provider id in URL first\n}","preventionTips":["Keep the callback URL format /api/auth/callback/<providerId> and match ids exactly.","Update the redirect URI at the OAuth provider whenever you rename a provider id.","Ensure reverse proxies don't strip or rewrite the provider path segment.","Share one providers array across all entry points (route handlers, middleware, actions)."],"tags":["callback","provider","routing","authjs"],"backgroundTag":"invalid-callback-provider","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}