{"record":{"id":"ba2aee578fe7a19d","repo":"mastra-ai/mastra","slug":"redirect-uri-is-required-for-google-sso-set-googl","errorCode":null,"errorMessage":"Redirect URI is required for Google SSO. Set GOOGLE_REDIRECT_URI or pass redirectUri.","messagePattern":"Redirect URI is required for Google SSO\\. Set GOOGLE_REDIRECT_URI or pass redirectUri\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"auth/google/src/auth-provider.ts","lineNumber":445,"sourceCode":"        return null;\n      }\n\n      return user;\n    } catch {\n      return null;\n    }\n  }\n\n  private attachSSOProvider(): void {\n    const self = this;\n\n    (this as unknown as ISSOProvider<GoogleUser>).getLoginUrl = async function (\n      redirectUri: string,\n      state: string,\n    ): Promise<string> {\n      const actualRedirectUri = redirectUri ?? self.redirectUri;\n      if (!actualRedirectUri) {\n        throw new Error('Redirect URI is required for Google SSO. Set GOOGLE_REDIRECT_URI or pass redirectUri.');\n      }\n\n      const nonce = crypto.randomUUID();\n      const signedState = await createStateToken(state, actualRedirectUri, nonce, self.cookiePassword);\n      const oauthState = `${signedState}${getServerRedirectStateSuffix(state)}`;\n      const params = new URLSearchParams({\n        client_id: self.clientId,\n        response_type: 'code',\n        scope: self.scopes.join(' '),\n        redirect_uri: actualRedirectUri,\n        state: oauthState,\n        nonce,\n      });\n\n      if (self.hostedDomain) {\n        params.set('hd', self.hostedDomain);\n      }\n","sourceCodeStart":427,"sourceCodeEnd":463,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/google/src/auth-provider.ts#L427-L463","documentation":"The SSO getLoginUrl implementation resolves the redirect URI from its argument or falls back to the provider's configured redirectUri (GOOGLE_REDIRECT_URI / options). Google's OAuth authorize endpoint requires a registered redirect_uri, so if neither source yields a value the library throws before building the login URL.","triggerScenarios":"Calling getLoginUrl(undefined/empty, state) on the MastraAuthGoogle SSO interface while neither GOOGLE_REDIRECT_URI is set nor redirectUri was passed in provider options — the actualRedirectUri resolves to falsy.","commonSituations":"Deploying behind a new domain without updating GOOGLE_REDIRECT_URI; wiring the SSO interface manually and omitting the redirectUri argument; env var present locally in .env but missing on the host; forgetting to register the redirect URI in Google Cloud Console (which causes a different Google-side error, but the missing env var causes this one first).","solutions":["Set the GOOGLE_REDIRECT_URI environment variable (e.g. https://yourapp.com/auth/google/callback).","Or pass redirectUri explicitly: provider.getLoginUrl('https://yourapp.com/auth/google/callback', state).","Or configure it in provider options: new MastraAuthGoogle({ redirectUri: '...' }).","Ensure the same URI is registered verbatim in Google Cloud Console OAuth client settings."],"exampleFix":"// before\nconst url = await sso.getLoginUrl(undefined, state); // throws\n\n// after\nconst url = await sso.getLoginUrl('https://myapp.com/auth/google/callback', state);","handlingStrategy":"validation","validationCode":"const redirectUri = process.env.GOOGLE_REDIRECT_URI;\nif (!redirectUri) {\n  throw new Error('Set GOOGLE_REDIRECT_URI (must match the URI registered in Google Cloud Console)');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const url = await sso.getLoginUrl(redirectUri, state);\n} catch (err) {\n  if (err instanceof Error && err.message.includes('Redirect URI is required')) {\n    console.error('Configure GOOGLE_REDIRECT_URI or pass redirectUri to getLoginUrl');\n    process.exit(1);\n  }\n  throw err;\n}","preventionTips":["Set GOOGLE_REDIRECT_URI in all environments; it must exactly match a URI registered in Google Cloud Console.","Pass the redirectUri explicitly at the call site if the provider isn't configured with one.","Validate required OAuth env vars (client ID, secret, redirect URI) at process startup.","Update the env var whenever the app's public base URL changes (new domain, added scheme, port change)."],"tags":["oauth","configuration","redirect-uri","google","sso"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}