mastra-ai/mastra · critical

[MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Go

Error message

[MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Google SSO in production. Set GOOGLE_COOKIE_PASSWORD or pass session.cookiePassword.

What it means

With SSO enabled, if no cookie password was explicitly configured (neither GOOGLE_COOKIE_PASSWORD nor session.cookiePassword), the provider only auto-generates a temporary one in non-production while warning. In NODE_ENV=production it throws, because an auto-generated password would invalidate all sessions on every restart and is unsafe for production.

Source

Thrown at auth/google/src/auth-provider.ts:278

    this.cookiePassword = cookiePassword;
    this.secureCookies = options?.session?.secureCookies ?? process.env.NODE_ENV === 'production';
    this.allowedDomains = allowedDomains;
    this.hostedDomain = configuredHostedDomain ?? (allowedDomains.length === 1 ? allowedDomains[0] : undefined);
    this.ssoEnabled = !!clientSecret;
    this.jwks = createRemoteJWKSet(new URL(GOOGLE_JWKS_URL));

    if (this.ssoEnabled) {
      if (cookiePassword.length < 32) {
        throw new Error(
          'Cookie password must be at least 32 characters for SSO. Set GOOGLE_COOKIE_PASSWORD environment variable.',
        );
      }

      if (!hasConfiguredCookiePassword) {
        const message =
          '[MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Google SSO in production. Set GOOGLE_COOKIE_PASSWORD or pass session.cookiePassword.';
        if (process.env.NODE_ENV === 'production') {
          throw new Error(message);
        }
        console.warn(
          `${message} Using an auto-generated value for development only; sessions will not survive restarts.`,
        );
      }

      this.attachSSOProvider();
      this.attachSessionProvider();
    }

    this.registerOptions(options);
  }

  async authenticateToken(token: string, request?: MastraAuthRequest): Promise<GoogleUser | null> {
    if (this.ssoEnabled && request) {
      const sessionUser = await this.getUserFromSessionCookie(request);
      if (sessionUser) return sessionUser;
    }

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set GOOGLE_COOKIE_PASSWORD (>= 32 chars) in the production environment.
2. Or pass session.cookiePassword in the provider options at construction.
3. If SSO is unintended, remove the Google client secret so the requirement disappears.
4. After setting it, redeploy/restart so sessions are encrypted with a stable key and survive restarts.

Example fix

// before (production deploy without cookie password)
GOOGLE_CLIENT_SECRET=...
# GOOGLE_COOKIE_PASSWORD not set -> throws

// after
GOOGLE_CLIENT_SECRET=...
GOOGLE_COOKIE_PASSWORD=Kj8mQ2vX7pLw3nRtY6bC1dF5gH9jS4aZ0eU2iO8pP3xN7q

if (process.env.NODE_ENV === 'production' && process.env.GOOGLE_CLIENT_SECRET && !process.env.GOOGLE_COOKIE_PASSWORD) {
  throw new Error('GOOGLE_COOKIE_PASSWORD is required in production for Google SSO');
}

try {
  const auth = new MastraAuthGoogle({ clientSecret });
} catch (err) {
  if (err instanceof Error && err.message.includes('GOOGLE_COOKIE_PASSWORD is required')) {
    console.error('Configure GOOGLE_COOKIE_PASSWORD before production deploy');
    process.exit(1);
  }
  throw err;
}

When it happens

Trigger: new MastraAuthGoogle(...) with a clientSecret configured, no GOOGLE_COOKIE_PASSWORD env var and no session.cookiePassword option, while process.env.NODE_ENV === 'production'.

Common situations: Deploying to a production environment where local dev worked (dev got the auto-generated value + warning) but prod fails; NODE_ENV newly set to 'production' on a host; platform env config omitting GOOGLE_COOKIE_PASSWORD while GOOGLE_CLIENT_SECRET is present.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Cookie password must be at least 32 characters for SSO. Set
• Okta client secret is required for SSO. Provide it in the op
• Okta redirect URI is required for SSO. Provide it in the opt
• ${name} must contain base64-encoded 32-byte keys.
• Cookie password must be at least 32 characters for SSO. Set

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/67bcda4b07dfb128. Report an issue: GitHub.