{"record":{"id":"f4b93034c6b29c3f","repo":"nextauthjs/next-auth","slug":"provider-not-supported","errorCode":null,"errorMessage":"Provider not supported","messagePattern":"Provider not supported","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/handle-login.ts","lineNumber":36,"sourceCode":" *\n * It prevents insecure behaviour, such as linking OAuth accounts unless a user is\n * signed in and authenticated with an existing valid account.\n *\n * All verification (e.g. OAuth flows or email address verification flows) are\n * done prior to this handler being called to avoid additional complexity in this\n * handler.\n */\nexport async function handleLoginOrRegister(\n  sessionToken: SessionToken,\n  _profile: User | AdapterUser | { email: string },\n  _account: AdapterAccount | Account | null,\n  options: InternalOptions\n) {\n  // Input validation\n  if (!_account?.providerAccountId || !_account.type)\n    throw new Error(\"Missing or invalid provider account\")\n  if (![\"email\", \"oauth\", \"oidc\", \"webauthn\"].includes(_account.type))\n    throw new Error(\"Provider not supported\")\n\n  const {\n    adapter,\n    jwt,\n    events,\n    session: { strategy: sessionStrategy, generateSessionToken },\n  } = options\n\n  // If no adapter is configured then we don't have a database and cannot\n  // persist data; in this mode we just return a dummy session object.\n  if (!adapter) {\n    return { user: _profile as User, account: _account as Account }\n  }\n\n  const profile = _profile as AdapterUser\n  let account = _account as AdapterAccount\n\n  const {","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/handle-login.ts#L18-L54","documentation":"handleLoginOrRegister only accepts account types 'email', 'oauth', 'oidc', and 'webauthn'. If the account object passed through the callback action has any other type value, it throws this Error at handle-login.ts:36. It guards the internal login/link flow from unsupported account kinds.","triggerScenarios":"An account object with type 'credentials' or an arbitrary custom string reaching the callback action; a custom provider setting an invalid account type; manually invoking the internal callback handler with a hand-built account.","commonSituations":"Trying to route Credentials Provider logins through the OAuth callback path; custom provider authors setting type to something like 'custom' expecting it to work; version mismatches between @auth/core and provider adapters that changed type constants.","solutions":["Set the account type to one of 'oauth', 'oidc', 'email', or 'webauthn' in your provider.","Use the Credentials Provider's built-in authorize() flow instead of the callback action for credentials logins.","Align @auth/core and provider package versions so the type enum matches."],"exampleFix":"// before\naccount = { providerAccountId: id, type: 'custom', provider: 'x' }\n// after\naccount = { providerAccountId: id, type: 'oauth', provider: 'x' }","handlingStrategy":"type-guard","validationCode":"const VALID_TYPES = ['email', 'oauth', 'oidc', 'webauthn']\nif (!VALID_TYPES.includes(account.type)) throw new Error(`Account type '${account.type}' not supported by callback flow`)","typeGuard":"function isSupportedAccountType(t: string): t is 'email' | 'oauth' | 'oidc' | 'webauthn' {\n  return ['email', 'oauth', 'oidc', 'webauthn'].includes(t)\n}","tryCatchPattern":"try {\n  await handleCallback(...)\n} catch (e) {\n  if ((e as Error).message === 'Provider not supported') {\n    // route credentials logins through authorize(), not the callback action\n  }\n}","preventionTips":["Use the Credentials Provider's authorize() for username/password flows, never the callback action.","Keep account.type values to the four documented constants.","Pin @auth/core and provider packages to compatible versions."],"tags":["oauth","provider","validation","callback"],"backgroundTag":"unsupported-provider-type","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}