Cookie password must be at least 32 characters. Set OKTA_COO

Error message

Cookie password must be at least 32 characters. Set OKTA_COOKIE_PASSWORD environment variable.

What it means

Validation thrown in the OktaAuthProvider constructor when the session cookie password is shorter than 32 characters. The cookie password is the encryption/signing key for the SSO session cookie, which requires at least 32 characters. Note the default (crypto.randomUUID() + crypto.randomUUID()) always satisfies this, so the error only fires when an explicit short password is supplied.

Source

Thrown at auth/okta/src/auth-provider.ts:175

      throw new Error(
        'Okta client ID is required. Provide it in the options or set OKTA_CLIENT_ID environment variable.',
      );
    }

    if (!clientSecret) {
      throw new Error(
        'Okta client secret is required for SSO. Provide it in the options or set OKTA_CLIENT_SECRET environment variable.',
      );
    }

    if (!redirectUri) {
      throw new Error(
        'Okta redirect URI is required for SSO. Provide it in the options or set OKTA_REDIRECT_URI environment variable.',
      );
    }

    if (cookiePassword.length < 32) {
      throw new Error('Cookie password must be at least 32 characters. Set OKTA_COOKIE_PASSWORD environment variable.');
    }

    this.domain = domain;
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    // Normalize trailing slashes so a stray `OKTA_ISSUER=https://domain/` doesn't produce `.../oauth2//v1/...`
    this.issuer = trimTrailingSlashes(issuer ?? `https://${domain}/oauth2/default`);
    // Org authorization servers use issuer `https://{domain}` but serve endpoints under `/oauth2/v1/*`.
    // Custom authorization servers use issuer `https://{domain}/oauth2/<name>` and serve endpoints under `<issuer>/v1/*`.
    // `issuer` is still used verbatim for JWT `iss`-claim validation on both server types.
    this.endpointBase =
      this.issuer.includes('/oauth2/') || this.issuer.endsWith('/oauth2') ? this.issuer : `${this.issuer}/oauth2`;
    this.redirectUri = redirectUri;
    // Defaults to the client ID, which is the `aud` of an Okta ID token. Deployments that
    // send access tokens need the authorization server's audience instead.
    this.audience = options?.audience ?? process.env.OKTA_AUDIENCE ?? clientId;
    this.scopes = options?.scopes ?? DEFAULT_SCOPES;
    this.cookieName = options?.session?.cookieName ?? DEFAULT_COOKIE_NAME;

View on GitHub (pinned to 75dd419e61)

Solutions

Set OKTA_COOKIE_PASSWORD to a string of at least 32 characters (e.g. generate with `openssl rand -base64 32`).
Remove the explicit cookiePassword so the provider generates a secure random default (note: not stable across restarts).
Verify the env var wasn't truncated by quoting rules or line-length limits in your .env/deployment config.
Keep the value stable per environment to avoid invalidating existing session cookies.

Example fix

// before
OKTA_COOKIE_PASSWORD=shortsecret
// after
OKTA_COOKIE_PASSWORD="openssl-rand-base64-32-generated-long-value-here=="

Defensive patterns

Strategy: validation

Validate before calling

const cp = process.env.OKTA_COOKIE_PASSWORD;
if (cp !== undefined && cp.length < 32) {
  throw new Error('OKTA_COOKIE_PASSWORD must be at least 32 characters');
}

Try / catch

try {
  auth = new OktaAuthProvider();
} catch (e) {
  if (e instanceof Error && e.message.includes('Cookie password must be at least 32')) {
    throw new Error('Replace OKTA_COOKIE_PASSWORD with a 32+ char secret (openssl rand -base64 32)');
  }
  throw e;
}

Prevention

Generate cookie passwords with openssl rand -base64 32 and store them in the secret manager.
Add a length check in your env-var startup validation.
Keep the value stable per environment to avoid invalidating sessions.

When it happens

Trigger: new OktaAuthProvider(...) with options.session.cookiePassword (or OKTA_COOKIE_PASSWORD) set to a string shorter than 32 characters.

Common situations: Developer sets a short placeholder like 'secret' in local env; env var contains a truncated or mis-copied value; a placeholder from documentation was never replaced.

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/7481532eb692e502. Report an issue: GitHub.