{"record":{"id":"ea3b257924de4380","repo":"mastra-ai/mastra","slug":"auth0-domain-and-audience-are-required-please-pro","errorCode":null,"errorMessage":"Auth0 domain and audience are required, please provide them in the options or set the environment variables AUTH0_DOMAIN and AUTH0_AUDIENCE","messagePattern":"Auth0 domain and audience are required, please provide them in the options or set the environment variables AUTH0_DOMAIN and AUTH0_AUDIENCE","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"auth/auth0/src/index.ts","lineNumber":300,"sourceCode":"  // SSO fields\n  private clientId: string | null;\n  private clientSecret: string | null;\n  private _redirectUri: string | null;\n  private scopes: string[];\n  private cookieName: string;\n  private cookieMaxAge: number;\n  private cookiePassword: string;\n  private secureCookies: boolean;\n  private ssoEnabled: boolean;\n\n  constructor(options?: MastraAuthAuth0Options) {\n    super({ name: options?.name ?? 'auth0' });\n\n    const domain = options?.domain ?? process.env.AUTH0_DOMAIN;\n    const audience = options?.audience ?? process.env.AUTH0_AUDIENCE;\n\n    if (!domain || !audience) {\n      throw new Error(\n        'Auth0 domain and audience are required, please provide them in the options or set the environment variables AUTH0_DOMAIN and AUTH0_AUDIENCE',\n      );\n    }\n\n    this.domain = domain;\n    this.audience = audience;\n\n    // SSO configuration (optional — enables Studio login)\n    const clientId = options?.clientId ?? process.env.AUTH0_CLIENT_ID;\n    const clientSecret = options?.clientSecret ?? process.env.AUTH0_CLIENT_SECRET;\n    const redirectUri = options?.redirectUri ?? process.env.AUTH0_REDIRECT_URI;\n    const cookiePassword =\n      options?.session?.cookiePassword ??\n      process.env.AUTH0_COOKIE_PASSWORD ??\n      crypto.randomUUID() + crypto.randomUUID();\n\n    this.clientId = clientId ?? null;\n    this.clientSecret = clientSecret ?? null;","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/auth/auth0/src/index.ts#L282-L318","documentation":"The AuthOServerAuth (auth0) provider constructor requires an Auth0 domain and audience, either passed via the options object or resolved from the AUTH0_DOMAIN and AUTH0_AUDIENCE environment variables. If neither source yields a truthy value, the constructor throws immediately at provider instantiation time so the misconfiguration fails fast instead of producing broken OAuth URLs later.","triggerScenarios":"Calling `new AuthOServerAuth()` (or the factory with auth0 provider config) with neither `options.domain`/`options.audience` set nor AUTH0_DOMAIN/AUTH0_AUDIENCE exported in the environment running the server.","commonSituations":"Deploying to a platform where .env files are not loaded (serverless, Docker without env_file); forgetting to set the env vars in CI/CD or production; passing only domain but not audience (or vice versa) in options; typos in env var names.","solutions":["Set both environment variables AUTH0_DOMAIN (e.g. dev-xyz.us.auth0.com) and AUTH0_AUDIENCE (your Auth0 API identifier) in the deployment environment","Pass them explicitly in options: new AuthOServerAuth({ domain: '...', audience: '...' })","Verify your .env file is actually loaded by the runtime (dotenv import, framework env loading) and included in the deployment artifact","Check for typos in variable names and that secrets are not scoped out in CI/CD"],"exampleFix":"// before\nnew AuthOServerAuth({ name: 'auth0' });\n// after\nnew AuthOServerAuth({\n  name: 'auth0',\n  domain: 'dev-xyz.us.auth0.com',\n  audience: 'https://my-api.example.com',\n});","handlingStrategy":"validation","validationCode":"function assertAuth0Config(opts) {\n  const domain = opts?.domain ?? process.env.AUTH0_DOMAIN;\n  const audience = opts?.audience ?? process.env.AUTH0_AUDIENCE;\n  if (!domain) throw new Error('AUTH0_DOMAIN (or options.domain) must be set');\n  if (!audience) throw new Error('AUTH0_AUDIENCE (or options.audience) must be set');\n  return { domain, audience };\n}\n// call before constructing the provider\nassertAuth0Config(options);","typeGuard":"function hasAuth0Env(env: NodeJS.ProcessEnv): env is NodeJS.ProcessEnv &\n  { AUTH0_DOMAIN: string; AUTH0_AUDIENCE: string } {\n  return Boolean(env.AUTH0_DOMAIN && env.AUTH0_AUDIENCE);\n}","tryCatchPattern":"let provider;\ntry {\n  provider = new AuthOServerAuth(options);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Auth0 domain and audience are required')) {\n    throw new Error('Auth0 provider misconfigured: set AUTH0_DOMAIN and AUTH0_AUDIENCE', { cause: e });\n  }\n  throw e;\n}","preventionTips":["Set AUTH0_DOMAIN and AUTH0_AUDIENCE at boot and fail fast in app startup if missing","Validate env vars with a schema validator (zod/env-schema) before constructing providers","Ensure .env files are loaded and included in deployments","Never configure domain without audience (or vice versa)"],"tags":["auth0","configuration","env-vars","missing-config"],"backgroundTag":"missing-env-var","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}