{"record":{"id":"b2932ad7de033956","repo":"mastra-ai/mastra","slug":"workos-redirect-uri-is-required-provide-it-in-the","errorCode":null,"errorMessage":"WorkOS redirect URI is required. Provide it in the options, set the WORKOS_REDIRECT_URI environment variable, or call init() with a publicUrl.","messagePattern":"WorkOS redirect URI is required\\. Provide it in the options, set the WORKOS_REDIRECT_URI environment variable, or call init\\(\\) with a publicUrl\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"auth/workos/src/auth-provider.ts","lineNumber":519,"sourceCode":"        return undefined;\n      }\n      current = (current as Record<string, unknown>)[segment];\n    }\n\n    return typeof current === 'string' ? current : undefined;\n  }\n\n  // ============================================================================\n  // ISSOProvider Implementation\n  // ============================================================================\n\n  /**\n   * Get the URL to redirect users to for SSO login.\n   */\n  getLoginUrl(redirectUri: string, state: string): string {\n    const resolvedRedirectUri = redirectUri || this.redirectUri;\n    if (!resolvedRedirectUri) {\n      throw new Error(\n        'WorkOS redirect URI is required. ' +\n          'Provide it in the options, set the WORKOS_REDIRECT_URI environment variable, or call init() with a publicUrl.',\n      );\n    }\n\n    const baseOptions = {\n      clientId: this.clientId,\n      redirectUri: resolvedRedirectUri,\n      state,\n    };\n\n    if (this.ssoConfig?.connection) {\n      return this.workos.userManagement.getAuthorizationUrl({\n        ...baseOptions,\n        connectionId: this.ssoConfig.connection,\n      });\n    } else if (this.ssoConfig?.provider) {\n      return this.workos.userManagement.getAuthorizationUrl({","sourceCodeStart":501,"sourceCodeEnd":537,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/workos/src/auth-provider.ts#L501-L537","documentation":"getLoginUrl() builds the WorkOS SSO authorization URL and requires a redirect URI. It uses the redirectUri argument, falling back to the provider's configured redirectUri (from options, WORKOS_REDIRECT_URI, or init(publicUrl)). If neither resolves, it throws because the OAuth flow has no callback address.","triggerScenarios":"Calling `auth.getLoginUrl()` (or the internal path that invokes it) with an empty redirectUri argument while the provider was constructed without WORKOS_REDIRECT_URI and init() was never called with a publicUrl.","commonSituations":"Deployed behind a proxy where publicUrl is not configured; env var name typo (WORKOS_REDIRECTURL); new environment (staging) missing the env var; calling getLoginUrl directly in custom code without passing a redirect URI.","solutions":["Set the WORKOS_REDIRECT_URI environment variable to your full callback URL","Call auth.init({ publicUrl: 'https://your-app.example.com' }) so the callback path can be derived","Pass the redirect URI explicitly to getLoginUrl(redirectUri, state)","Ensure the redirect URI is registered as an allowed redirect in the WorkOS dashboard"],"exampleFix":"// before\nconst auth = new MastraAuthWorkos({ apiKey, clientId });\nconst url = auth.getLoginUrl('', state);\n// after\nconst auth = new MastraAuthWorkos({ apiKey, clientId, redirectUri: 'https://app.example.com/auth/callback' });\nconst url = auth.getLoginUrl();","handlingStrategy":"validation","validationCode":"function assertRedirectUri(opts, hostPublicUrl) {\n  const uri = opts?.redirectUri ?? process.env.WORKOS_REDIRECT_URI ??\n    (hostPublicUrl ? new URL('/auth/callback', hostPublicUrl).toString() : null);\n  if (!uri) throw new Error('WorkOS redirect URI missing: set WORKOS_REDIRECT_URI or configure publicUrl');\n  if (!uri.startsWith('https://') && !uri.startsWith('http://localhost')) {\n    throw new Error('WorkOS redirect URI must be an absolute URL: ' + uri);\n  }\n  return uri;\n}","typeGuard":"function canResolveLoginUrl(opts, hostPublicUrl) {\n  return Boolean(opts?.redirectUri || process.env.WORKOS_REDIRECT_URI || hostPublicUrl);\n}","tryCatchPattern":"try {\n  const url = auth.getLoginUrl(redirectUriArg, state);\n} catch (e) {\n  if (e.message.includes('redirect URI is required')) {\n    throw new ConfigError('Set WORKOS_REDIRECT_URI or call auth.init({ publicUrl }) before login');\n  }\n  throw e;\n}","preventionTips":["Always call init({ publicUrl }) in hosted environments behind proxies","Register every environment's callback URL in the WorkOS dashboard","Pass the redirect URI explicitly when calling getLoginUrl from custom code","Add a startup assertion that the resolved redirect URI is an absolute https URL"],"tags":["config","workos","sso","oauth","redirect-uri"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}