mastra-ai/mastra · error

Redirect URI is required for SSO. Set AUTH0_REDIRECT_URI or

Error message

Redirect URI is required for SSO. Set AUTH0_REDIRECT_URI or pass redirectUri option.

What it means

The SSO provider's getLoginUrl builds the Auth0 authorization URL and needs a redirect URI for the OAuth callback. It first uses the redirectUri argument, falling back to the instance's configured _redirectUri (from AUTH0_REDIRECT_URI or the redirectUri option). This error is thrown when both are empty, meaning no callback URL is available to include in the login URL.

Source

Thrown at auth/auth0/src/index.ts:506

      return null; // Invalid/corrupt cookie
    }
  }

  // ============================================================================
  // Dynamic ISSOProvider attachment (only when OAuth is configured)
  // ============================================================================

  /**
   * Dynamically attach ISSOProvider methods to this instance.
   * This ensures duck-typing detection only finds these methods when SSO is configured.
   */
  private _attachSSOProvider() {
    const self = this;

    (this as unknown as ISSOProvider<EEUser>).getLoginUrl = function (redirectUri: string, state: string): string {
      const actualRedirectUri = redirectUri ?? self._redirectUri;
      if (!actualRedirectUri) {
        throw new Error('Redirect URI is required for SSO. Set AUTH0_REDIRECT_URI or pass redirectUri option.');
      }

      // Create a signed state token that encodes redirectUri (stateless, works in serverless/multi-instance)
      const signedState = createStateToken(state, actualRedirectUri, self.cookiePassword);

      const params = new URLSearchParams({
        client_id: self.clientId!,
        response_type: 'code',
        scope: self.scopes.join(' '),
        redirect_uri: actualRedirectUri,
        state: signedState,
      });

      return `https://${self.domain}/authorize?${params.toString()}`;
    };

    (this as unknown as ISSOProvider<EEUser>).handleCallback = async function (
      code: string,

View on GitHub (pinned to 75dd419e61)

Solutions

1. Set AUTH0_REDIRECT_URI (e.g. https://yourapp.com/api/auth/callback) in the environment
2. Pass redirectUri in the provider constructor options: new AuthOServerAuth({ ..., redirectUri: 'https://...' })
3. Pass a non-empty redirectUri argument directly to getLoginUrl(url, state)
4. Verify the URI is also registered in the Auth0 application's Allowed Callback URLs

Example fix

// before
const url = provider.getLoginUrl(undefined, state);
// after
const url = provider.getLoginUrl('https://myapp.com/api/auth/callback', state);
// or better, configure once:
new AuthOServerAuth({ redirectUri: 'https://myapp.com/api/auth/callback', ... });

const redirectUri =
  explicitRedirectUri ?? process.env.AUTH0_REDIRECT_URI ?? configuredOption?.redirectUri;
if (!redirectUri) {
  throw new Error('Set AUTH0_REDIRECT_URI or pass redirectUri option before calling getLoginUrl');
}

try {
  const url = provider.getLoginUrl(redirectUri, state);
} catch (e) {
  if (e instanceof Error && e.message.includes('Redirect URI is required for SSO')) {
    throw new Error('SSO login URL cannot be built: configure AUTH0_REDIRECT_URI or the redirectUri option', { cause: e });
  }
  throw e;
}

When it happens

Trigger: Calling getLoginUrl(redirectUri, state) with undefined/null redirectUri while the provider was constructed without a redirectUri option and without AUTH0_REDIRECT_URI set in the environment.

Common situations: Deploying without AUTH0_REDIRECT_URI in env vars; calling getLoginUrl programmatically and passing undefined for the redirect param; forgetting the option when constructing the provider in a new service; the callback URL not matching what's registered in the Auth0 application settings.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Redirect URI is required for Google SSO. Set GOOGLE_REDIRECT
• WorkOS redirect URI is required. Provide it in the options,
• Invalid state token format
• Invalid or tampered state token
• Invalid state token payload

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/60de8c8d1d92016c. Report an issue: GitHub.