{"record":{"id":"d412f807479c9151","repo":"PrefectHQ/fastmcp","slug":"missing-required-base-url","errorCode":null,"errorMessage":"Missing required base URL","messagePattern":"Missing required base URL","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/oidc_proxy.py","lineNumber":363,"sourceCode":"            identity_assertion: Optional SEP-990 identity assertion (ID-JAG) configuration.\n                When provided, the token endpoint accepts the RFC 7523 jwt-bearer grant\n                carrying an ID-JAG issued by one of the configured trusted issuers.\n        \"\"\"\n        if not config_url:\n            raise ValueError(\"Missing required config URL\")\n\n        if not client_id:\n            raise ValueError(\"Missing required client id\")\n\n        if not client_secret and not jwt_signing_key:\n            raise ValueError(\n                \"Either client_secret or jwt_signing_key must be provided. \"\n                \"jwt_signing_key is required when client_secret is omitted \"\n                \"(e.g., for PKCE public clients).\"\n            )\n\n        if not base_url:\n            raise ValueError(\"Missing required base URL\")\n\n        # Validate that verifier-specific parameters are not used with custom verifier\n        if token_verifier is not None:\n            if algorithm is not None:\n                raise ValueError(\n                    \"Cannot specify 'algorithm' when providing a custom token_verifier. \"\n                    \"Configure the algorithm on your token verifier instead.\"\n                )\n            if required_scopes is not None:\n                raise ValueError(\n                    \"Cannot specify 'required_scopes' when providing a custom token_verifier. \"\n                    \"Configure required scopes on your token verifier instead.\"\n                )\n\n        if isinstance(config_url, str):\n            config_url = AnyHttpUrl(config_url)\n\n        self.oidc_config = self.get_oidc_configuration(","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/oidc_proxy.py#L345-L381","documentation":"OIDCProxy requires base_url (the publicly reachable URL of the FastMCP server, used to build OAuth redirect/callback routes) and raises ValueError when it is falsy.","triggerScenarios":"Constructing OIDCProxy(...) with base_url=None/\"\" or omitted — commonly when the deployment URL env var is unset or the server constructs auth before base_url is known.","commonSituations":"Local dev behind tunnels where BASE_URL isn't configured; container deployments missing the public hostname env; ordering issue where the auth provider is built before the server URL is computed.","solutions":["Pass the server's public base URL (e.g. https://myserver.example.com/) to OIDCProxy","Set and load the deployment's BASE_URL env var before constructing the auth provider","Also register the resulting callback URL with your OIDC provider to avoid later redirect mismatches"],"exampleFix":"// before\nproxy = OIDCProxy(config_url=..., client_id=\"app\", client_secret=..., base_url=os.getenv(\"BASE_URL\"))  # unset\n// after\nbase_url = os.environ[\"BASE_URL\"]\nproxy = OIDCProxy(config_url=..., client_id=\"app\", client_secret=..., base_url=base_url)","handlingStrategy":"validation","validationCode":"base_url = os.environ.get(\"BASE_URL\")\nif not base_url:\n    raise ValueError(\"BASE_URL (public server URL) is required for OAuth callbacks\")","typeGuard":null,"tryCatchPattern":"try:\n    proxy = OIDCProxy(config_url=..., client_id=..., client_secret=..., base_url=base_url)\nexcept ValueError as e:\n    logger.error(\"OIDCProxy misconfigured: %s\", e)\n    raise SystemExit(1)","preventionTips":["Set BASE_URL in every deployment (including local dev tunnels)","Register the derived callback URL with your OIDC provider","Construct the auth provider after the server URL is known, not before"],"tags":["oidc","configuration","missing-parameter"],"backgroundTag":"missing-required-parameter","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}