medusajs/medusa · critical · Error

Github clientSecret is required

Error message

Github clientSecret is required

What it means

The Github auth provider requires a `clientSecret` alongside the clientId to complete the OAuth code exchange. `validateOptions` throws at startup when it is missing.

Source

Thrown at packages/modules/providers/auth-github/src/services/github.ts:33

  logger: Logger
}

interface LocalServiceConfig extends GithubAuthProviderOptions {}

export class GithubAuthService extends AbstractAuthModuleProvider {
  static identifier = "github"
  static DISPLAY_NAME = "Github Authentication"

  protected config_: LocalServiceConfig
  protected logger_: Logger

  static validateOptions(options: GithubAuthProviderOptions) {
    if (!options.clientId) {
      throw new Error("Github clientId is required")
    }

    if (!options.clientSecret) {
      throw new Error("Github clientSecret is required")
    }

    if (!options.callbackUrl) {
      throw new Error("Github callbackUrl is required")
    }
  }

  constructor(
    { logger }: InjectedDependencies,
    options: GithubAuthProviderOptions
  ) {
    // @ts-ignore
    super(...arguments)
    this.config_ = options
    this.logger_ = logger
  }

  async register(_): Promise<AuthenticationResponse> {

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Set clientSecret in provider options from GITHUB_CLIENT_SECRET
2. Verify the env var value matches the OAuth app's client secret exactly (no quotes/whitespace)

Example fix

// before
options: { clientId: process.env.GITHUB_CLIENT_ID }
// after
options: { clientId: process.env.GITHUB_CLIENT_ID, clientSecret: process.env.GITHUB_CLIENT_SECRET, callbackUrl: process.env.GITHUB_CALLBACK_URL }

for (const k of ['GITHUB_CLIENT_ID', 'GITHUB_CLIENT_SECRET', 'GITHUB_CALLBACK_URL']) {
  if (!process.env[k]) throw new Error(`Missing env var: ${k}`)
}

When it happens

Trigger: Registering the github auth provider with a clientId but no clientSecret, or the GITHUB_CLIENT_SECRET env var not being set.

Common situations: Client secret not generated/copied from the Github OAuth app settings, secret stripped from the environment for security without replacement, or trailing whitespace/newline in the pasted secret breaking env parsing.

Related errors

• Github clientId is required
• Github callbackUrl is required
• Google clientId is required
• Google clientSecret is required
• OIDC engine requires an 'issuer' option

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/6688cf03c2e8fe4a. Report an issue: GitHub.