nextauthjs/next-auth · error · Error

data.message

Error message

data.message

What it means

SvelteKit's auth() handle helper (in lib/actions.ts, used by the handle hook) parses the response from the Auth.js backend and throws Error(data.message) for non-200 statuses. The backend's 'message' field is surfaced directly; a 200 with an empty payload returns null. Because auth() wraps every server request via handle, this error can surface on any page load when the auth core fails.

Source

Thrown at packages/frameworks-sveltekit/src/lib/actions.ts:147

  )
  const request = new Request(sessionUrl, {
    headers: { cookie: req.headers.get("cookie") ?? "" },
  })
  const response = await Auth(request, config)

  const authCookies = parse(response.headers.getSetCookie())
  for (const cookie of authCookies) {
    const { name, value, ...options } = cookie
    // @ts-expect-error - Review: SvelteKit and set-cookie-parser are mismatching
    event.cookies.set(name, value, { path: "/", ...options })
  }

  const { status = 200 } = response
  const data = await response.json()

  if (!data || !Object.keys(data).length) return null
  if (status === 200) return data
  throw new Error(data.message)
}

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Read data.message in the thrown error to identify the underlying Auth.js core failure.
2. Set AUTH_SECRET in your deployment environment (SvelteKit reads .env only in dev).
3. Set AUTH_TRUST_HOST=true when running behind a proxy, or configure trustHost: true in the config.
4. Verify the auth catch-all route exists at src/routes/auth/[...auth]/+server.ts and matches the basePath.

Example fix

// before
// hooks.server.ts
export const handle = authHandle // throws on non-200 from auth core
// after
// Set env in deployment platform:
// AUTH_SECRET=... AUTH_TRUST_HOST=true
export const handle = authHandle

// At server start (dev or prod):
if (!process.env.AUTH_SECRET && !import.meta.env.DEV) {
  console.warn("AUTH_SECRET is not set; auth() will fail in production")
}

function isSession(data: unknown): data is { user?: { id?: string; email?: string } } & Record<string, unknown> {
  return typeof data === "object" && data !== null && !((data as any) instanceof Error)
}

try {
  const session = await auth() // inside load/actions via locals
} catch (err) {
  console.error("Auth.js error (SvelteKit):", (err as Error).message)
  return { session: null }
}

When it happens

Trigger: Any server request flowing through the SvelteKit handle hook that triggers an internal auth fetch returning non-200 — missing AUTH_SECRET in .env, untrusted host in production (AUTH_TRUST_HOST unset behind a proxy), misconfigured auth route at src/routes/auth/[...auth], or a provider/adapter runtime error.

Common situations: Deployments to Vercel/Netlify/Node where AUTH_SECRET wasn't added to the platform's env settings; apps using a custom domain behind a reverse proxy causing UntrustedHost; renaming the /auth route without updating basePath.

Related errors

• data.message
• data.message
• data.message
• Couldn't create session
• [createSession] Failed to fetch created session

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/513ab5ac85aa2829. Report an issue: GitHub.