medusajs/medusa · critical · MedusaError

OIDC provider requires a 'client_id' option

Error message

OIDC provider requires a 'client_id' option

What it means

validateOptions throws INVALID_DATA when client_id is absent. The client_id identifies your application to the identity provider and is required for both the authorization and token endpoints.

Source

Thrown at packages/modules/providers/auth-oidc/src/services/oidc.ts:44

  static identifier = "oidc"
  static DISPLAY_NAME = "OpenID Connect"

  protected readonly config_: OidcAuthProviderOptions
  protected readonly logger_: Logger
  protected readonly engine_: OidcEngine

  static validateOptions(options: OidcAuthProviderOptions) {
    if (!options.issuer) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "OIDC provider requires an 'issuer' option"
      )
    }

    assertSecureUrl(options.issuer, "issuer")

    if (!options.client_id) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "OIDC provider requires a 'client_id' option"
      )
    }

    if (!options.callback_url) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "OIDC provider requires a 'callback_url' option"
      )
    }
  }

  constructor(
    { logger, cache }: InjectedDependencies,
    options: OidcAuthProviderOptions
  ) {
    // @ts-ignore

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Add client_id to the provider options using the OAuth client ID from your IdP app registration.
2. Verify the env var is exported in the environment Medusa runs in (not just your shell).
3. Cross-check against the IdP's credentials page; regenerate/rotate if the client was deleted.

Example fix

// before
options: { issuer: "...", callback_url: "..." }
// after
options: { issuer: "...", client_id: process.env.OIDC_CLIENT_ID, callback_url: "..." }

if (!process.env.OIDC_CLIENT_ID) {
  throw new Error("OIDC_CLIENT_ID is not set; cannot configure the oidc auth provider")
}

const hasClientId = (o: Partial<OidcAuthProviderOptions>): o is OidcAuthProviderOptions =>
  typeof o.client_id === "string" && o.client_id.length > 0

try { OidcAuthService.validateOptions(options) } catch (e) { if (e instanceof MedusaError && /'client_id'/.test(e.message)) { /* report missing credential */ } throw e }

When it happens

Trigger: Provider options in medusa-config.js omit client_id, or it is set from an env var that resolves to undefined.

Common situations: Copied the OAuth client credentials from the wrong panel field (using the provider's app ID instead of the OAuth client ID); env var missing in CI/production while working locally; the IdP project was recreated and the old client_id removed.

Related errors

• OIDC engine requires a 'callback_url' option
• OIDC provider requires an 'issuer' option
• OIDC engine requires an 'issuer' option
• OIDC engine requires a 'client_id' option
• OIDC provider requires a 'callback_url' option

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/fc47e90e5a57894d. Report an issue: GitHub.