mastra-ai/mastra · error · HTTPException

SSO not configured

Error message

SSO not configured

What it means

This HTTP 404 error is thrown by the SSO login-url route when there is no auth provider for the request context (studio vs non-studio), or the configured provider does not implement `getLoginUrl` (ISSOProvider). Mastra only exposes SSO login when an SSO-capable provider is configured.

Source

Thrown at packages/server/src/server/handlers/auth.ts:358

// GET /auth/sso/login
// ============================================================================

export const GET_SSO_LOGIN_ROUTE = createPublicRoute({
  method: 'GET',
  path: '/auth/sso/login',
  responseType: 'datastream-response',
  queryParamSchema: ssoLoginQuerySchema,
  summary: 'Initiate SSO login',
  description: 'Returns the SSO login URL and sets PKCE cookies if needed.',
  tags: ['Auth'],
  handler: async ctx => {
    try {
      const { mastra, redirect_uri, request, routePrefix } = ctx as any;
      const isStudio = isStudioRequest(request);
      const auth = getAuthProvider(mastra, isStudio);

      if (!auth || !implementsInterface<ISSOProvider>(auth, 'getLoginUrl')) {
        throw new HTTPException(404, { message: 'SSO not configured' });
      }

      // Build OAuth callback URI using the configured route prefix
      const origin = getPublicOrigin(request);
      const raw = ((routePrefix as string) || '/api').trim();
      const withSlash = raw.startsWith('/') ? raw : `/${raw}`;
      const prefix = withSlash.endsWith('/') ? withSlash.slice(0, -1) : withSlash;
      const oauthCallbackUri = `${origin}${prefix}/auth/sso/callback`;

      // Encode the post-login redirect in state (where user goes after auth completes)
      // State format: uuid|postLoginRedirect
      // Validate redirect_uri to prevent open-redirect attacks: allow relative paths,
      // same-origin URLs, and localhost URLs (for dev setups where Studio runs on a
      // different port).
      let postLoginRedirect = '/';
      if (redirect_uri) {
        if (!redirect_uri.startsWith('http')) {
          // Relative path — always safe

View on GitHub (pinned to 75dd419e61)

Solutions

  1. Configure an SSO provider (implementing getLoginUrl) on the Mastra server auth config.
  2. If you don't need SSO, stop calling the SSO login endpoint and use the credentials/sign-in flow instead.
  3. Check whether the request targets studio or API context — make sure the provider is configured for that context (getAuthProvider's isStudio branch).

Example fix

// before
new Mastra({ server: { authConfig: undefined } });
// after
new Mastra({
  server: {
    authConfig: new MySSOProvider(), // implements getLoginUrl()
  },
});
Defensive patterns

Strategy: validation

Validate before calling

// probe whether SSO is available before redirecting the user
const res = await fetch('/api/auth/sso/login-url', { method: 'HEAD' });
const ssoAvailable = res.status !== 404;

Try / catch

try {
  const res = await fetch('/api/auth/sso/login-url');
  if (res.status === 404) {
    // SSO not configured: fall back to credentials sign-in UI
    showCredentialsForm();
  }
} catch (e) { showCredentialsForm(); }

Prevention

When it happens

Trigger: GET the SSO login route when: getAuthProvider(mastra, isStudio) returns undefined, or the provider lacks a getLoginUrl method — i.e. no SSO provider configured for that context.

Common situations: Running without an auth provider configured at all; using a credentials-only provider and hitting SSO routes; studio/non-studio provider resolution picks a provider without SSO support; misconfigured Mastra server auth options.

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/00ecfe9da2057d24. Report an issue: GitHub.