Authorization server did not provide an authorization endpoi

Error message

Authorization server did not provide an authorization endpoint.

What it means

After successful OIDC discovery, Auth.js requires the provider metadata to include an authorization_endpoint. If the discovery document decodes successfully but lacks that field, this TypeError is thrown because the library cannot build the sign-in redirect URL.

Source

Thrown at packages/core/src/lib/actions/signin/authorization-url.ts:44

    const issuer = new URL(provider.issuer!)
    const discoveryResponse = await o.discoveryRequest(issuer, {
      [o.customFetch]: provider[customFetch],
      // TODO: move away from allowing insecure HTTP requests
      [o.allowInsecureRequests]: true,
    })
    const as = await o
      .processDiscoveryResponse(issuer, discoveryResponse)
      .catch((error) => {
        if (!(error instanceof TypeError) || error.message !== "Invalid URL")
          throw error
        throw new TypeError(
          `Discovery request responded with an invalid issuer. expected: ${issuer}`
        )
      })

    if (!as.authorization_endpoint) {
      throw new TypeError(
        "Authorization server did not provide an authorization endpoint."
      )
    }

    url = new URL(as.authorization_endpoint)
  }

  const authParams = url.searchParams

  let redirect_uri: string = provider.callbackUrl
  let data: string | undefined
  if (!options.isOnRedirectProxy && provider.redirectProxyUrl) {
    redirect_uri = provider.redirectProxyUrl
    data = provider.callbackUrl
    logger.debug("using redirect proxy", { redirect_uri, data })
  }

  const params = Object.assign(

View on GitHub (pinned to a1a16a5a77)

Solutions

For OAuth2-only providers, remove issuer/wellKnown and configure the endpoints explicitly: authorization: { url: 'https://provider.com/oauth/authorize' }, token: '...', userinfo: '...'
Inspect the discovery document output and confirm authorization_endpoint is present; fix the provider's discovery configuration if it is missing
If the document is behind a rewrite/proxy serving the wrong file, point issuer at the correct well-known location
Upgrade Auth.js if the provider advertises authorization_endpoint only in a newer metadata revision, or hardcode the endpoint as a workaround

Example fix

// before
const provider = { id: 'custom', issuer: 'https://api.example.com' }; // OAuth2-only, no discovery
// after
const provider = {
  id: 'custom',
  authorization: { url: 'https://api.example.com/oauth/authorize' },
  token: 'https://api.example.com/oauth/token',
  userinfo: 'https://api.example.com/oauth/userinfo',
};

Defensive patterns

Strategy: validation

Validate before calling

const doc = await fetch(`${issuer}/.well-known/openid-configuration`).then(r => r.json());
if (!doc.authorization_endpoint) throw new Error('Provider metadata lacks authorization_endpoint; configure endpoints manually');

Type guard

function hasAuthorizationEndpoint(doc: object): doc is { authorization_endpoint: string } {
  return typeof (doc as any).authorization_endpoint === 'string';
}

Try / catch

try {
  await signIn(providerId);
} catch (e) {
  if (/did not provide an authorization endpoint/.test(String(e))) {
    // fall back to explicitly configured authorization url for OAuth2-only providers
  }
}

Prevention

Only use issuer-based discovery for true OIDC providers; plain OAuth2 needs explicit endpoints
Inspect the discovery JSON with curl to confirm authorization_endpoint exists
Check provider realm/tenant path in the issuer URL is correct (Keycloak, Hydra)
Verify the discovery URL is not being served a partial or error document by a proxy

When it happens

Trigger: Provider's /.well-known/openid-configuration returns metadata without authorization_endpoint — typical of OAuth2-only servers (no OIDC), partially implemented providers, or misconfigured discovery endpoints that return minimal/empty metadata.

Common situations: Using issuer-based discovery against a plain OAuth2 provider (GitHub, custom APIs) that has no authorization_endpoint in metadata; provider misconfiguration returning an error JSON with 200 status; self-hosted Keycloak/Hydra exposing partial document; forgetting to set authorization endpoint manually for non-OIDC providers.

Related errors

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/d831072084da79da. Report an issue: GitHub.