mastra-ai/mastra · error

WorkOS provider requested but the active factory auth provid

Error message

WorkOS provider requested but the active factory auth provider is not WorkOS

What it means

getWorkOSProvider returns the active factory auth provider narrowed to MastraAuthWorkos. It is documented to be called only after gating on isWorkOSAuth; if the active provider is a different auth provider (or undefined), it throws rather than returning the wrong client.

Source

Thrown at mastracode/factory/src/auth.ts:335

    ensureUser: (c: Context) => ensureFactoryAuthUser(provider, c),
    tenant: (c: Context) => factoryAuthTenant(c),
    isOrganizationAdmin: (c: Context, organizationId: string) => isOrganizationAdmin(provider, c, organizationId),
  };
}

/** True when the given provider is WorkOS. Gates WorkOS-only capabilities. */
export function isWorkOSAuth(provider: IMastraAuthProvider | undefined): boolean {
  return provider instanceof MastraAuthWorkos;
}

/**
 * The raw WorkOS provider, for features that need the WorkOS client directly
 * (audit-log export, Admin Portal links). Callers must gate on
 * {@link isWorkOSAuth} first — throws when the provider is not WorkOS.
 */
export function getWorkOSProvider(provider: IMastraAuthProvider | undefined): MastraAuthWorkos {
  if (provider instanceof MastraAuthWorkos) return provider;
  throw new Error('WorkOS provider requested but the active factory auth provider is not WorkOS');
}

/**
 * Resolve the authenticated user for a request, stashing it on the context.
 *
 * The gate only authenticates non-`/auth/*` requests via the `Authorization`
 * header, so cookie-based browser navigations to public `/auth/*` routes (the
 * GitHub connect/callback flow) arrive without a gate-stashed user. This reads
 * the session cookie from the raw request the same way `/auth/me` does,
 * caches the result on the context, and returns it so downstream helpers like
 * {@link factoryAuthTenant} work uniformly on both gated and public routes.
 *
 * Returns `undefined` when there is no valid session (or auth is disabled).
 */
export async function ensureFactoryAuthUser(
  provider: IMastraAuthProvider | undefined,
  c: Context,
): Promise<FactoryAuthUser | undefined> {

View on GitHub (pinned to 75dd419e61)

Solutions

1. Gate the call with isWorkOSAuth(provider) before invoking getWorkOSProvider.
2. Configure the factory's auth provider to WorkOS if WorkOS features are required in that environment.
3. Handle the undefined/mismatched-provider case gracefully (skip WorkOS-only features).

Example fix

// before
const workos = getWorkOSProvider(provider);
// after
if (isWorkOSAuth(provider)) {
  const workos = getWorkOSProvider(provider);
  // export audit logs...
}

if (!provider || !isWorkOSAuth(provider)) {
  // skip WorkOS-only feature or configure WorkOS as the factory auth provider
  return;
}

function isWorkOSProvider(p: IMastraAuthProvider | undefined): p is MastraAuthWorkos {
  return p instanceof MastraAuthWorkos;
}

try {
  const workos = getWorkOSProvider(provider);
  // use workos client
} catch (e) {
  if ((e as Error).message.includes('not WorkOS')) {
    console.warn('WorkOS features disabled: active auth provider is not WorkOS');
    return;
  }
  throw e;
}

When it happens

Trigger: Calling getWorkOSProvider(provider) with a provider that is not an instance of MastraAuthWorkos — e.g. the factory is configured with another auth provider (Keycloak, custom, none) or provider is undefined.

Common situations: Features like audit-log export or Admin Portal links run unconditionally in environments where the deployment uses a non-WorkOS auth provider; local/dev setups without WorkOS configured; provider never assigned before the feature path runs.

Related errors

• State token has expired
• Clerk JWKS URI, secret key and publishable key are required,
• Cookie password must be at least 32 characters for SSO. Set
• Redirect URI is required for SSO login
• Token exchange failed: ${error}

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/4ccaaf44b18b0640. Report an issue: GitHub.