medusajs/medusa · critical · Error

Google callbackUrl is required

Error message

Google callbackUrl is required

What it means

The Google auth provider requires the `callbackUrl` — the redirect URI Google sends users back to after consent. `validateOptions` throws at startup if it is absent.

Source

Thrown at packages/modules/providers/auth-google/src/services/google.ts:50

export class GoogleAuthService extends AbstractAuthModuleProvider {
  static identifier = "google"
  static DISPLAY_NAME = "Google Authentication"

  protected config_: LocalServiceConfig
  protected logger_: Logger
  protected jwks_: JwksClient

  static validateOptions(options: GoogleAuthProviderOptions) {
    if (!options.clientId) {
      throw new Error("Google clientId is required")
    }

    if (!options.clientSecret) {
      throw new Error("Google clientSecret is required")
    }

    if (!options.callbackUrl) {
      throw new Error("Google callbackUrl is required")
    }
  }

  constructor(
    { logger }: InjectedDependencies,
    options: GoogleAuthProviderOptions
  ) {
    // @ts-ignore
    super(...arguments)
    this.config_ = options
    this.logger_ = logger
    this.jwks_ = jwksClient({
      jwksUri: GOOGLE_JWKS_URI,
      cache: true,
      rateLimit: true,
    })
  }

View on GitHub (pinned to 5e06e544a2)

Solutions

  1. Set callbackUrl in options, e.g. `${BACKEND_URL}/auth/google/google/callback`
  2. Add the exact same URI to the OAuth client's Authorized redirect URIs in Google Cloud Console

Example fix

// before
options: { clientId, clientSecret }
// after
options: { clientId, clientSecret, callbackUrl: `${process.env.MEDUSA_BACKEND_URL}/auth/google/google/callback` }
Defensive patterns

Strategy: validation

Validate before calling

const googleCallback = `${process.env.MEDUSA_BACKEND_URL}/auth/google/google/callback`
assertUrlRegisteredInConsole(googleCallback)

Prevention

When it happens

Trigger: Registering auth-google without callbackUrl, or deriving it from an undefined BACKEND_URL env var.

Common situations: Callback URL not registered under 'Authorized redirect URIs' in Google Cloud Console, or local/production URL mismatch.

Related errors


AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/b092db73c73e8973. Report an issue: GitHub.