{"record":{"id":"c1631898f38d87df","repo":"mastra-ai/mastra","slug":"okta-domain-is-required-provide-it-in-the-options-c16318","errorCode":null,"errorMessage":"Okta domain is required. Provide it in the options or set OKTA_DOMAIN environment variable.","messagePattern":"Okta domain is required\\. Provide it in the options or set OKTA_DOMAIN environment variable\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"auth/okta/src/rbac-provider.ts","lineNumber":95,"sourceCode":"   * Expose roleMapping for middleware access.\n   * This allows the authorization middleware to resolve permissions\n   * without needing to call the async methods.\n   */\n  get roleMapping(): RoleMapping {\n    return this.options.roleMapping;\n  }\n\n  /**\n   * Create a new Okta RBAC provider.\n   *\n   * @param options - RBAC configuration options\n   */\n  constructor(options: MastraRBACOktaOptions) {\n    const domain = options.domain ?? process.env.OKTA_DOMAIN;\n    const apiToken = options.apiToken ?? process.env.OKTA_API_TOKEN;\n\n    if (!domain) {\n      throw new Error(\n        'Okta domain is required. ' + 'Provide it in the options or set OKTA_DOMAIN environment variable.',\n      );\n    }\n\n    if (!apiToken) {\n      throw new Error(\n        'Okta API token is required for RBAC. ' +\n          'Provide it in the options or set OKTA_API_TOKEN environment variable.',\n      );\n    }\n\n    this.oktaClient = new Client({\n      orgUrl: `https://${domain}`,\n      token: apiToken,\n    });\n\n    this.options = options;\n","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/okta/src/rbac-provider.ts#L77-L113","documentation":"MastraAuthOkta's RBAC provider requires an Okta domain to construct its Okta API client. The constructor resolves the domain from options.domain first, then the OKTA_DOMAIN environment variable. If neither is set, it throws immediately at construction time so misconfiguration fails fast rather than at first request.","triggerScenarios":"Calling `new MastraRBACOkta(options)` where options.domain is undefined and process.env.OKTA_DOMAIN is unset or empty.","commonSituations":"Forgetting to load a .env file before instantiating; deploying to an environment where OKTA_DOMAIN was never set; passing the wrong option key name (e.g. {oktaDomain}) so options.domain is undefined.","solutions":["Set the OKTA_DOMAIN environment variable (e.g. dev-12345678.okta.com)","Pass domain explicitly: new MastraRBACOkta({ domain: 'dev-12345678.okta.com', apiToken })","Verify your .env file is actually loaded (dotenv/config, platform env settings) before construction","Ensure the env var name is exactly OKTA_DOMAIN (case-sensitive)"],"exampleFix":"// before\nconst rbac = new MastraRBACOkta({ apiToken: token });\n// after\nconst rbac = new MastraRBACOkta({ domain: process.env.OKTA_DOMAIN, apiToken: token });","handlingStrategy":"validation","validationCode":"function assertOktaConfig(opts) {\n  const domain = opts?.domain ?? process.env.OKTA_DOMAIN;\n  if (!domain) throw new Error('OKTA domain missing: set OKTA_DOMAIN or pass options.domain');\n  if (!/^https?:\\/\\/.+|^.+\\.okta\\.com\\/?$/.test(domain)) throw new Error('OKTA domain looks invalid: ' + domain);\n  return domain;\n}","typeGuard":"function hasOktaDomain(o) {\n  return typeof o === 'object' && o !== null && typeof o.domain === 'string' && o.domain.length > 0;\n}","tryCatchPattern":"let rbac;\ntry {\n  rbac = new MastraRBACOkta(options);\n} catch (e) {\n  if (e.message.includes('OKTA_DOMAIN')) {\n    throw new ConfigError('Okta RBAC misconfigured: set OKTA_DOMAIN or pass { domain }');\n  }\n  throw e;\n}","preventionTips":["Validate all Okta env vars at app startup with a single config-assert module","Add OKTA_DOMAIN to deployment secret checklists and CI config smoke tests","Fail fast: construct providers in an init() that runs before the server accepts traffic","Use a typed options factory that loads process.env once and validates"],"tags":["config","env-var","okta","constructor"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}