{"record":{"id":"7bb7dbc853d8dea2","repo":"medusajs/medusa","slug":"oidc-provider-requires-an-issuer-option","errorCode":null,"errorMessage":"OIDC provider requires an 'issuer' option","messagePattern":"OIDC provider requires an 'issuer' option","errorType":"validation","errorClass":"MedusaError","httpStatus":400,"severity":"critical","filePath":"packages/modules/providers/auth-oidc/src/services/oidc.ts","lineNumber":35,"sourceCode":"type InjectedDependencies = {\n  logger: Logger\n  cache?: ICacheService\n}\n\n// A generic failure message returned to the client; the detailed cause is only ever logged server-side.\nconst GENERIC_AUTH_ERROR = \"Authentication failed\"\n\nexport class OidcAuthService extends AbstractAuthModuleProvider {\n  static identifier = \"oidc\"\n  static DISPLAY_NAME = \"OpenID Connect\"\n\n  protected readonly config_: OidcAuthProviderOptions\n  protected readonly logger_: Logger\n  protected readonly engine_: OidcEngine\n\n  static validateOptions(options: OidcAuthProviderOptions) {\n    if (!options.issuer) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"OIDC provider requires an 'issuer' option\"\n      )\n    }\n\n    assertSecureUrl(options.issuer, \"issuer\")\n\n    if (!options.client_id) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"OIDC provider requires a 'client_id' option\"\n      )\n    }\n\n    if (!options.callback_url) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"OIDC provider requires a 'callback_url' option\"","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/providers/auth-oidc/src/services/oidc.ts#L17-L53","documentation":"The auth-oidc provider service validates its options at startup via static validateOptions; it throws INVALID_DATA when issuer is missing. The issuer URL is what openid-client uses for discovery, so it is mandatory.","triggerScenarios":"Registering the oidc auth provider in medusa-config.js without an issuer option, or with issuer: undefined because an env var is unset.","commonSituations":"Env var (e.g. OIDC_ISSUER) not set in the deployment environment; typo in the key name (e.g. issuerUrl); config scaffolded from a template that left issuer blank.","solutions":["Set issuer in the provider options to your IdP's discovery base URL (e.g. https://accounts.google.com or https://auth.example.com/realms/main).","Verify the URL responds at <issuer>/.well-known/openid-configuration.","If sourced from env, confirm the variable is set where Medusa actually runs and restart the server."],"exampleFix":"// before\noptions: { client_id: \"...\", callback_url: \"...\" }\n// after\noptions: { issuer: process.env.OIDC_ISSUER, client_id: \"...\", callback_url: process.env.OIDC_CALLBACK_URL }","handlingStrategy":"validation","validationCode":"if (!process.env.OIDC_ISSUER) {\n  throw new Error(\"OIDC_ISSUER is not set; cannot configure the oidc auth provider\")\n}","typeGuard":"const hasIssuer = (o: Partial<OidcAuthProviderOptions>): o is OidcAuthProviderOptions =>\n  typeof o.issuer === \"string\" && o.issuer.length > 0","tryCatchPattern":"try { OidcAuthService.validateOptions(options) } catch (e) { if (e instanceof MedusaError && e.type === MedusaError.Types.INVALID_DATA) { /* report config error before boot */ } throw e }","preventionTips":["Run validateOptions (or your own check) in a config test before deploying.","Keep issuer in env vars with a startup presence check.","Point issuer at the base URL; verify /.well-known/openid-configuration responds."],"tags":["oidc","configuration","startup","auth-provider"],"backgroundTag":"missing-config-option","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}