mastra-ai/mastra · error

Okta client secret is required for SSO. Provide it in the op

Error message

Okta client secret is required for SSO. Provide it in the options or set OKTA_CLIENT_SECRET environment variable.

What it means

Validation thrown in the OktaAuthProvider constructor when no client secret is provided via options or OKTA_CLIENT_SECRET. Because the provider uses a confidential (client_secret) OIDC flow for SSO, the secret is mandatory.

Source

Thrown at auth/okta/src/auth-provider.ts:163

    const clientId = options?.clientId ?? process.env.OKTA_CLIENT_ID;
    const clientSecret = options?.clientSecret ?? process.env.OKTA_CLIENT_SECRET;
    const issuer = options?.issuer ?? process.env.OKTA_ISSUER;
    const redirectUri = options?.redirectUri ?? process.env.OKTA_REDIRECT_URI;
    const cookiePassword =
      options?.session?.cookiePassword ?? process.env.OKTA_COOKIE_PASSWORD ?? crypto.randomUUID() + crypto.randomUUID();

    if (!domain) {
      throw new Error('Okta domain is required. Provide it in the options or set OKTA_DOMAIN environment variable.');
    }

    if (!clientId) {
      throw new Error(
        'Okta client ID is required. Provide it in the options or set OKTA_CLIENT_ID environment variable.',
      );
    }

    if (!clientSecret) {
      throw new Error(
        'Okta client secret is required for SSO. Provide it in the options or set OKTA_CLIENT_SECRET environment variable.',
      );
    }

    if (!redirectUri) {
      throw new Error(
        'Okta redirect URI is required for SSO. Provide it in the options or set OKTA_REDIRECT_URI environment variable.',
      );
    }

    if (cookiePassword.length < 32) {
      throw new Error('Cookie password must be at least 32 characters. Set OKTA_COOKIE_PASSWORD environment variable.');
    }

    this.domain = domain;
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    // Normalize trailing slashes so a stray `OKTA_ISSUER=https://domain/` doesn't produce `.../oauth2//v1/...`

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set the OKTA_CLIENT_SECRET environment variable from the Okta application's client credentials.
2. Pass `clientSecret` explicitly in the constructor options.
3. If the secret was rotated, generate/retrieve the current one from the Okta admin console and redeploy.
4. Ensure your secret manager (vault, platform secrets) is wired into the service.

Example fix

// before
new OktaAuthProvider({ domain, clientId });
// after
new OktaAuthProvider({ domain, clientId, clientSecret: process.env.OKTA_CLIENT_SECRET });

if (!process.env.OKTA_CLIENT_SECRET) {
  throw new Error('Set OKTA_CLIENT_SECRET before constructing OktaAuthProvider');
}
const auth = new OktaAuthProvider();

try {
  auth = new OktaAuthProvider();
} catch (e) {
  if (e instanceof Error && e.message.includes('client secret is required')) {
    throw new Error('Server misconfiguration: OKTA_CLIENT_SECRET missing');
  }
  throw e;
}

When it happens

Trigger: new OktaAuthProvider(...) with domain and clientId set but neither options.clientSecret nor OKTA_CLIENT_SECRET defined.

Common situations: Secret not synced to the deployment environment; secret rotated/revoked in Okta; using a 'public' SPA-style app config with this confidential client provider.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Okta redirect URI is required for SSO. Provide it in the opt
• [MastraAuthGoogle] GOOGLE_COOKIE_PASSWORD is required for Go
• Okta domain is required. Provide it in the options or set OK
• Okta client ID is required. Provide it in the options or set
• Cookie password must be at least 32 characters for SSO. Set

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/9b647ae1b7c1986f. Report an issue: GitHub.