What causes "Callback route called without provider" in nextauthjs/next-auth?

Ensure the callback URL includes the provider id and that a provider with exactly that id is in the providers array.

nextauthjs/next-auth · error · InvalidProvider

Callback route called without provider

Error message

Callback route called without provider

What it means

The callback route (/api/auth/callback/...) requires that the provider was resolved from the URL and matched a configured provider. If options.provider is undefined — the provider segment is missing or does not correspond to any configured provider — InvalidProvider is thrown at callback/index.ts:40.

Source

Thrown at packages/core/src/lib/actions/callback/index.ts:40

  ResponseInternal,
  User,
} from "../../../types.js"
import type { Cookie, SessionStore } from "../../utils/cookie.js"
import {
  assertInternalOptionsWebAuthn,
  verifyAuthenticate,
  verifyRegister,
} from "../../utils/webauthn-utils.js"

/** Handle callbacks from login services */
export async function callback(
  request: RequestInternal,
  options: InternalOptions,
  sessionStore: SessionStore,
  cookies: Cookie[]
): Promise<ResponseInternal> {
  if (!options.provider)
    throw new InvalidProvider("Callback route called without provider")
  const { query, body, method, headers } = request
  const {
    provider,
    adapter,
    url,
    callbackUrl,
    pages,
    jwt,
    events,
    callbacks,
    session: { strategy: sessionStrategy, maxAge: sessionMaxAge },
    logger,
  } = options

  const useJwtSession = sessionStrategy === "jwt"

  try {
    if (provider.type === "oauth" || provider.type === "oidc") {

View on GitHub (pinned to a1a16a5a77)

Solutions

Ensure the callback URL includes the provider id and that a provider with exactly that id is in the providers array.
Update the callback/redirect URI registered at the OAuth provider to match your route (/api/auth/callback/<provider>).
Check for URL typos and proxy/rewrite rules that strip the provider segment.
If you renamed a provider, keep the old id as an alias or update all sign-in links.

Example fix

// before
providers: [GitHub] // id changed to 'github-enterprise'
// old links point to /api/auth/callback/github
// after
providers: [GitHub({ id: 'github' })] // keep id stable or update links/redirect URIs

Defensive patterns

Strategy: validation

Validate before calling

const configuredIds = providers.map(p => 'id' in p ? p.id : p.prototype?.id)
if (!configuredIds.includes(providerParam)) {
  throw new Error(`Provider '${providerParam}' is not configured`)
}

Try / catch

try {
  const res = await fetch(callbackUrl)
} catch (e) {
  // InvalidProvider surfaces as a 500 on the route; check provider id in URL first
}

Prevention

Keep the callback URL format /api/auth/callback/<providerId> and match ids exactly.
Update the redirect URI at the OAuth provider whenever you rename a provider id.
Ensure reverse proxies don't strip or rewrite the provider path segment.
Share one providers array across all entry points (route handlers, middleware, actions).

When it happens

Trigger: Hitting /api/auth/callback without a provider segment; a typo in the provider id in the URL (e.g. /callback/googel); the provider was removed from the providers array but old sign-in links still reference it; custom route handlers that invoke the internal callback action without provider context.

Common situations: Misconfigured reverse proxy rewriting the callback path; renaming a provider id but forgetting to update the callback URL registered at the IdP; multiple auth entry points where one does not pass the same providers list.

Related errors

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/6ae17daefc835234. Report an issue: GitHub.