mastra-ai/mastra · error

Cookie password must be at least 32 characters for SSO. Set

Error message

Cookie password must be at least 32 characters for SSO. Set CLERK_COOKIE_PASSWORD environment variable.

What it means

When OAuth credentials (client id + secret) are present, SSO mode is enabled and the provider encrypts session/state data with a cookie password using AES. Node's crypto enforces a minimum key length for the AES-256 key derivation used here, so if the resolved cookiePassword is shorter than 32 characters the constructor throws instead of silently deriving a weak key. The password comes from options.session.cookiePassword or CLERK_COOKIE_PASSWORD.

Source

Thrown at auth/clerk/src/index.ts:323

      options?.session?.cookiePassword ??
      process.env.CLERK_COOKIE_PASSWORD ??
      crypto.randomUUID() + crypto.randomUUID();

    this.oauthClientId = oauthClientId ?? null;
    this.oauthClientSecret = oauthClientSecret ?? null;
    this._redirectUri = redirectUri ?? null;
    this.scopes = options?.scopes ?? DEFAULT_SCOPES;
    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;
    this.cookieMaxAge = options?.session?.cookieMaxAge ?? DEFAULT_COOKIE_MAX_AGE;
    this.cookiePassword = cookiePassword;
    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';

    // SSO is enabled when OAuth credentials are configured
    this.ssoEnabled = !!(oauthClientId && oauthClientSecret);

    if (this.ssoEnabled) {
      if (cookiePassword.length < 32) {
        throw new Error(
          'Cookie password must be at least 32 characters for SSO. Set CLERK_COOKIE_PASSWORD environment variable.',
        );
      }

      if (!options?.session?.cookiePassword && !process.env.CLERK_COOKIE_PASSWORD) {
        console.warn(
          '[MastraAuthClerk] No cookie password set — using auto-generated value. Sessions will not survive restarts. Set CLERK_COOKIE_PASSWORD for production use.',
        );
      }

      // Dynamically add ISSOProvider + ISessionProvider methods
      // so that duck-typing detection (implementsInterface) only finds them when SSO is configured
      this._attachSSOProvider();
      this._attachSessionProvider();
    }

    this.registerOptions(options);
  }

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set CLERK_COOKIE_PASSWORD to a string of at least 32 characters (e.g. a 32+ char random secret).
2. Or pass options: new ClerkAuthProvider({ ..., session: { cookiePassword: '<32+ chars>' } }).
3. Generate one with `openssl rand -base64 32` (or `node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`).
4. If you don't need SSO, remove oauthClientId/oauthClientSecret so the password requirement doesn't apply.

Example fix

// before
CLERK_COOKIE_PASSWORD=short-secret
// after
CLERK_COOKIE_PASSWORD=openssl-rand-base64-32-output-which-is-at-least-32-chars-long

const cookiePassword = process.env.CLERK_COOKIE_PASSWORD;
if (ssoEnabled && (!cookiePassword || cookiePassword.length < 32)) {
  throw new Error('CLERK_COOKIE_PASSWORD must be set and >= 32 characters');
}

When it happens

Trigger: Constructing ClerkAuthProvider with oauthClientId and oauthClientSecret set while the effective cookiePassword (options.session.cookiePassword ?? CLERK_COOKIE_PASSWORD) has length < 32.

Common situations: A short placeholder like 'password123' or a dev value promoted to production; the env var set to a 16/24-char string; assuming any non-empty password works once SSO is enabled; truncation of the value by a deployment platform.

Related errors

• Redirect URI is required for SSO login
• Clerk JWKS URI, secret key and publishable key are required,
• Cookie password must be at least 32 characters for SSO. Set
• Cookie password must be at least 32 characters for SSO. Set
• State token has expired

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/8751f4d031a4379b. Report an issue: GitHub.