{"record":{"id":"9b647ae1b7c1986f","repo":"mastra-ai/mastra","slug":"okta-client-secret-is-required-for-sso-provide-it","errorCode":null,"errorMessage":"Okta client secret is required for SSO. Provide it in the options or set OKTA_CLIENT_SECRET environment variable.","messagePattern":"Okta client secret is required for SSO\\. Provide it in the options or set OKTA_CLIENT_SECRET environment variable\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/okta/src/auth-provider.ts","lineNumber":163,"sourceCode":"    const clientId = options?.clientId ?? process.env.OKTA_CLIENT_ID;\n    const clientSecret = options?.clientSecret ?? process.env.OKTA_CLIENT_SECRET;\n    const issuer = options?.issuer ?? process.env.OKTA_ISSUER;\n    const redirectUri = options?.redirectUri ?? process.env.OKTA_REDIRECT_URI;\n    const cookiePassword =\n      options?.session?.cookiePassword ?? process.env.OKTA_COOKIE_PASSWORD ?? crypto.randomUUID() + crypto.randomUUID();\n\n    if (!domain) {\n      throw new Error('Okta domain is required. Provide it in the options or set OKTA_DOMAIN environment variable.');\n    }\n\n    if (!clientId) {\n      throw new Error(\n        'Okta client ID is required. Provide it in the options or set OKTA_CLIENT_ID environment variable.',\n      );\n    }\n\n    if (!clientSecret) {\n      throw new Error(\n        'Okta client secret is required for SSO. Provide it in the options or set OKTA_CLIENT_SECRET environment variable.',\n      );\n    }\n\n    if (!redirectUri) {\n      throw new Error(\n        'Okta redirect URI is required for SSO. Provide it in the options or set OKTA_REDIRECT_URI environment variable.',\n      );\n    }\n\n    if (cookiePassword.length < 32) {\n      throw new Error('Cookie password must be at least 32 characters. Set OKTA_COOKIE_PASSWORD environment variable.');\n    }\n\n    this.domain = domain;\n    this.clientId = clientId;\n    this.clientSecret = clientSecret;\n    // Normalize trailing slashes so a stray `OKTA_ISSUER=https://domain/` doesn't produce `.../oauth2//v1/...`","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/okta/src/auth-provider.ts#L145-L181","documentation":"Validation thrown in the OktaAuthProvider constructor when no client secret is provided via options or OKTA_CLIENT_SECRET. Because the provider uses a confidential (client_secret) OIDC flow for SSO, the secret is mandatory.","triggerScenarios":"new OktaAuthProvider(...) with domain and clientId set but neither options.clientSecret nor OKTA_CLIENT_SECRET defined.","commonSituations":"Secret not synced to the deployment environment; secret rotated/revoked in Okta; using a 'public' SPA-style app config with this confidential client provider.","solutions":["Set the OKTA_CLIENT_SECRET environment variable from the Okta application's client credentials.","Pass `clientSecret` explicitly in the constructor options.","If the secret was rotated, generate/retrieve the current one from the Okta admin console and redeploy.","Ensure your secret manager (vault, platform secrets) is wired into the service."],"exampleFix":"// before\nnew OktaAuthProvider({ domain, clientId });\n// after\nnew OktaAuthProvider({ domain, clientId, clientSecret: process.env.OKTA_CLIENT_SECRET });","handlingStrategy":"validation","validationCode":"if (!process.env.OKTA_CLIENT_SECRET) {\n  throw new Error('Set OKTA_CLIENT_SECRET before constructing OktaAuthProvider');\n}\nconst auth = new OktaAuthProvider();","typeGuard":null,"tryCatchPattern":"try {\n  auth = new OktaAuthProvider();\n} catch (e) {\n  if (e instanceof Error && e.message.includes('client secret is required')) {\n    throw new Error('Server misconfiguration: OKTA_CLIENT_SECRET missing');\n  }\n  throw e;\n}","preventionTips":["Sync secrets from your secret manager before provider construction.","Track secret rotation events and update deployments immediately.","Never commit secrets; keep environment-specific secrets out of code paths."],"tags":["okta","configuration","env-var","sso"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}