medusajs/medusa · critical · Error

Github callbackUrl is required

Error message

Github callbackUrl is required

What it means

The Github auth provider needs a `callbackUrl` — the URL Github redirects to after authorization — and `validateOptions` throws at startup when it is absent.

Source

Thrown at packages/modules/providers/auth-github/src/services/github.ts:37

export class GithubAuthService extends AbstractAuthModuleProvider {
  static identifier = "github"
  static DISPLAY_NAME = "Github Authentication"

  protected config_: LocalServiceConfig
  protected logger_: Logger

  static validateOptions(options: GithubAuthProviderOptions) {
    if (!options.clientId) {
      throw new Error("Github clientId is required")
    }

    if (!options.clientSecret) {
      throw new Error("Github clientSecret is required")
    }

    if (!options.callbackUrl) {
      throw new Error("Github callbackUrl is required")
    }
  }

  constructor(
    { logger }: InjectedDependencies,
    options: GithubAuthProviderOptions
  ) {
    // @ts-ignore
    super(...arguments)
    this.config_ = options
    this.logger_ = logger
  }

  async register(_): Promise<AuthenticationResponse> {
    throw new MedusaError(
      MedusaError.Types.NOT_ALLOWED,
      "Github does not support registration. Use method `authenticate` instead."
    )

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Set callbackUrl in options, e.g. `${BACKEND_URL}/auth/github/${authProviderId}/callback`
2. Ensure the same URL is registered as the Authorization callback URL in the Github OAuth app settings

Example fix

// before
options: { clientId, clientSecret }
// after
options: { clientId, clientSecret, callbackUrl: `${process.env.MEDUSA_BACKEND_URL}/auth/github/github/callback` }

const callbackUrl = `${process.env.MEDUSA_BACKEND_URL}/auth/github/google/callback`
if (!process.env.MEDUSA_BACKEND_URL) throw new Error('MEDUSA_BACKEND_URL required for callbackUrl')

When it happens

Trigger: Configuring the provider without `callbackUrl`, or building it from an env var like MEDUSA_BACKEND_URL that is undefined.

Common situations: Local vs production URL differences, forgetting to set the callback URL env var, or the callbackUrl not matching the one registered in the Github OAuth app.

Related errors

• Github clientId is required
• Github clientSecret is required
• Google callbackUrl is required
• Github does not support registration. Use method `authentica
• Google clientId is required

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/a3a6f8f780706089. Report an issue: GitHub.