Could not load settings from '${settings.configurationEndpoi

Error message

Could not load settings from '${settings.configurationEndpoint}'

What it means

Thrown by AuthenticationService.createUserManager() in the Oidc/ApiAuthorization interop (AuthenticationService.ts:491) when fetching the OIDC discovery/configuration document from settings.configurationEndpoint returns a non-OK HTTP response (!response.ok). The configuration endpoint (typically '/_configuration/{AppName}') returns the issuer, clientId, scopes, and metadata the oidc-client UserManager needs; without it the UserManager cannot be created, so the app cannot authenticate.

Source

Thrown at src/Components/WebAssembly/WebAssembly.Authentication/src/Interop/AuthenticationService.ts:491

    }

    public static async completeSignOut(url: string) {
        let operation = this._pendingOperations[url];
        if (!operation) {
            operation = AuthenticationService.instance.completeSignOut(url);
            await operation;
            delete this._pendingOperations[url];
        }

        return operation;
    }

    private static async createUserManager(settings: OidcAuthorizeServiceSettings): Promise<UserManager> {
        let finalSettings: UserManagerSettings;
        if (isApiAuthorizationSettings(settings)) {
            const response = await fetch(settings.configurationEndpoint);
            if (!response.ok) {
                throw new Error(`Could not load settings from '${settings.configurationEndpoint}'`);
            }

            const downloadedSettings = await response.json();

            finalSettings = downloadedSettings;
        } else {
            if (!settings.scope) {
                settings.scope = settings.defaultScopes.join(' ');
            }

            if (settings.response_type === null) {
                // If the response type is not set, it gets serialized as null. OIDC-client behaves differently than when the value is undefined, so we explicitly check for a null value and remove the property instead.
                delete settings.response_type;
            }

            finalSettings = settings;
        }

View on GitHub (pinned to 294cab2f9b)

Solutions

Open settings.configurationEndpoint (e.g., /_configuration/YourApp) directly in a browser and confirm it returns 200 JSON; fix the 4xx/5xx shown.
Verify AddApiAuthorization/AddOidc uses the correct application/client name matching what the client requests.
Ensure app.MapFallback/MapControllerRoute and the authentication endpoints are registered in Program.cs and not shadowed.
Check that a reverse proxy rewrites the path correctly and that no auth middleware blocks the configuration route before it runs.

Example fix

// before — wrong app name
services.AddApiAuthorization(options => { /* none */ });
Blazor.start({ configure: c => c.Settings.configurationEndpoint = '/_configuration/WrongName' });

// after
services.AddApiAuthorization("CorrectName", ...);
// fetch /_configuration/CorrectName → 200 OK with OIDC config

Defensive patterns

Strategy: try-catch

Validate before calling

async function configurationAvailable(endpoint: string): Promise<boolean> {
  try { const r = await fetch(endpoint); return r.ok; } catch { return false; }
}

Try / catch

try {
  await AuthenticationService.init(...);
} catch (e) {
  if (/Could not load settings/i.test(e.message)) {
    console.error('OIDC config endpoint failed — check /_configuration/<AppName>');
  }
  throw e;
}

Prevention

Hit /_configuration/<AppName> in a browser to confirm 200 before booting.
Use the exact application name registered via AddApiAuthorization/AddOidc.
Ensure auth endpoints are mapped and not shadowed by routing.
Verify reverse proxy path rewriting.

When it happens

Trigger: fetch(settings.configurationEndpoint) returns a 4xx/5xx (e.g., 404 for a misnamed application, 500 from the server, or a redirect). The endpoint must return 200 with the OIDC settings JSON; any other status throws.

Common situations: Application name passed to AddOidc/ApiAuthorization does not match a registered client/config (404). Server not started or mis-routed so /_configuration/... 404s. Authentication not wired in Program.cs (endpoint missing). Reverse proxy stripping the path. Anti-forgery/CORS/auth middleware blocking the endpoint before it serves config. Running the client without the server host.

Related errors

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/1a277a5c846c42df. Report an issue: GitHub.