mastra-ai/mastra · error · Error

Cookie password must be at least 32 characters. Set WORKOS_C

Error message

Cookie password must be at least 32 characters. Set WORKOS_COOKIE_PASSWORD environment variable or provide session.cookiePassword option.

What it means

The WorkOS auth provider uses a cookie password to encrypt session cookies, and WorkOS requires it to be at least 32 characters. If options.session.cookiePassword, WORKOS_COOKIE_PASSWORD, or the built-in dev fallback resolve to a value shorter than 32 chars, construction throws to prevent insecure or invalid session encryption.

Source

Thrown at auth/workos/src/auth-provider.ts:139

    const apiKey = options?.apiKey ?? process.env.WORKOS_API_KEY;
    const clientId = options?.clientId ?? process.env.WORKOS_CLIENT_ID;
    // The redirect URI may be resolved later: `init()` derives it from the
    // host's `publicUrl` when neither the option nor the env var is set.
    // `getLoginUrl()` fails with a clear error if it never resolves.
    const redirectUri = options?.redirectUri ?? process.env.WORKOS_REDIRECT_URI ?? '';
    const cookiePassword =
      options?.session?.cookiePassword ?? process.env.WORKOS_COOKIE_PASSWORD ?? DEV_COOKIE_PASSWORD;

    if (!apiKey || !clientId) {
      throw new Error(
        'WorkOS API key and client ID are required. ' +
          'Provide them in the options or set WORKOS_API_KEY and WORKOS_CLIENT_ID environment variables.',
      );
    }

    if (cookiePassword.length < 32) {
      throw new Error(
        'Cookie password must be at least 32 characters. ' +
          'Set WORKOS_COOKIE_PASSWORD environment variable or provide session.cookiePassword option.',
      );
    }

    this.clientId = clientId;
    this.redirectUri = redirectUri;
    this.ssoConfig = options?.sso;
    this.fetchMemberships = options?.fetchMemberships ?? false;
    this.trustJwtClaims = options?.trustJwtClaims ?? false;
    this.jwtClaimOptions = options?.jwtClaims;
    this.mapJwtPayloadToUser = options?.mapJwtPayloadToUser;
    this.membershipCache = new LRUCache<string, OrganizationMembership[]>({
      max: MEMBERSHIP_CACHE_MAX_SIZE,
      ttl: MEMBERSHIP_CACHE_TTL_MS,
    });

    // Create WorkOS client

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set WORKOS_COOKIE_PASSWORD to a strong value of at least 32 characters (e.g. generate with `openssl rand -base64 32`)
2. Pass session.cookiePassword explicitly with a >=32 char value
3. Check the raw env var length — surrounding quotes are not stripped in all dotenv setups
4. Use the same value across all instances; changing it invalidates existing sessions

Example fix

// before
WORKOS_COOKIE_PASSWORD=shortsecret
// after
WORKOS_COOKIE_PASSWORD=openssl-rand-base64-32-output-here>=32chars

function assertCookiePassword(opts) {
  const pw = opts?.session?.cookiePassword ?? process.env.WORKOS_COOKIE_PASSWORD;
  if (!pw || pw.length < 32) {
    throw new Error('WORKOS_COOKIE_PASSWORD must be at least 32 chars (got ' + (pw?.length ?? 0) + ')');
  }
  return pw;
}

function hasValidCookiePassword(o) {
  const pw = o?.session?.cookiePassword;
  return typeof pw === 'string' && pw.length >= 32;
}

try {
  auth = new MastraAuthWorkos(options);
} catch (e) {
  if (e.message.includes('Cookie password must be at least 32 characters')) {
    throw new ConfigError('Generate one: openssl rand -base64 32');
  }
  throw e;
}

When it happens

Trigger: `new MastraAuthWorkos(options)` where the resolved cookiePassword (option > env > DEV_COOKIE_PASSWORD) has length < 32.

Common situations: Short placeholder passwords set in env ('mysecret'); DEV_COOKIE_PASSWORD fallback leaking into a developer's setup and being rejected by policy; password truncated by quotes/whitespace issues in env files; someone rotating the secret to a shorter value.

Related errors

• Cookie password must be at least 32 characters. Set OKTA_COO
• WorkOS API key and client ID are required. Provide them in t
• WorkOS redirect URI is required. Provide it in the options,
• MastraAuthWorkos could not resolve a callback URL: pass `red
• WorkOS webhook secret is required. Provide it in options or

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/7cb21bb143c9b3db. Report an issue: GitHub.