{"record":{"id":"7c19e30e047f0ba0","repo":"nextauthjs/next-auth","slug":"no-userinfo-endpoint-configured","errorCode":null,"errorMessage":"No userinfo endpoint configured","messagePattern":"No userinfo endpoint configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/oauth/callback.ts","lineNumber":285,"sourceCode":"    }\n  } else {\n    if (userinfo?.request) {\n      const _profile = await userinfo.request({ tokens, provider })\n      if (_profile instanceof Object) profile = _profile\n    } else if (userinfo?.url) {\n      const userinfoResponse = await o.userInfoRequest(\n        as,\n        client,\n        processedCodeResponse.access_token,\n        {\n          [o.customFetch]: provider[customFetch],\n          // TODO: move away from allowing insecure HTTP requests\n          [o.allowInsecureRequests]: true,\n        }\n      )\n      profile = await userinfoResponse.json()\n    } else {\n      throw new TypeError(\"No userinfo endpoint configured\")\n    }\n  }\n\n  if (tokens.expires_in) {\n    tokens.expires_at =\n      Math.floor(Date.now() / 1000) + Number(tokens.expires_in)\n  }\n\n  const profileResult = await getUserAndAccount(\n    profile,\n    provider,\n    tokens,\n    logger\n  )\n\n  return { ...profileResult, profile, cookies: resCookies }\n}\n","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/oauth/callback.ts#L267-L303","documentation":"handleOAuth throws this TypeError when neither the provider config nor the provider's discovered OIDC metadata supplies a userinfo endpoint, but the flow still needs to fetch the user profile. The library refuses to guess an endpoint and aborts the callback.","triggerScenarios":"A custom/generic OAuth provider is defined without `userinfo` set, `wellKnown` discovery is absent or fails to include userinfo_endpoint, and `id_token` either lacks required claims or the flow proceeds to fetch profile — reaching the `else` branch that throws.","commonSituations":"Hand-rolled provider configs copied from old NextAuth examples that omitted `userinfo`; OAuth2 providers that only return an id_token and define no userinfo route; typo in `wellKnown` URL so discovery metadata is missing.","solutions":["Add the `userinfo` URL to the provider config (e.g. userinfo: \"https://api.example.com/user\").","Or set `wellKnown` to the issuer's discovery document so userinfo_endpoint is discovered automatically.","If the provider has no userinfo endpoint at all, switch to an OIDC provider config whose id_token carries the needed claims.","Verify the discovery URL returns valid metadata containing userinfo_endpoint."],"exampleFix":"// before\nconst GitHub = {\n  id: \"github\",\n  type: \"oauth\",\n  authorization: \"https://github.com/login/oauth/authorize\",\n  token: \"https://github.com/login/oauth/access_token\",\n}\n// after\nconst GitHub = {\n  id: \"github\",\n  type: \"oauth\",\n  authorization: \"https://github.com/login/oauth/authorize\",\n  token: \"https://github.com/login/oauth/access_token\",\n  userinfo: \"https://api.github.com/user\",\n}","handlingStrategy":"validation","validationCode":"const provider = { id: \"custom\", type: \"oauth\", userinfo: undefined }\nif (!provider.userinfo && !provider.wellKnown) {\n  throw new Error(\"Provider needs `userinfo` or a discoverable `wellKnown` URL\")\n}","typeGuard":"function hasUserinfo(p: { userinfo?: string; wellKnown?: string }): boolean {\n  return typeof p.userinfo === \"string\" || typeof p.wellKnown === \"string\"\n}","tryCatchPattern":null,"preventionTips":["Always define `userinfo` on custom non-OIDC providers","Prefer `wellKnown` discovery when the issuer supports OIDC metadata","Fetch your wellKnown URL once at startup and assert userinfo_endpoint exists"],"tags":["oauth","configuration","userinfo","provider-config"],"backgroundTag":"missing-provider-endpoint-config","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}