nextauthjs/next-auth · error · Error

data.message

Error message

data.message

What it means

The Qwik framework adapter's getSessionData parses the response from the Auth.js backend and throws Error(data.message) when the status is not 200. Like other framework adapters, it surfaces the backend's own 'message' field verbatim. Status 200 returns the data with cookie; an empty payload returns { data: null, cookie } instead of throwing.

Source

Thrown at packages/frameworks-qwik/src/index.ts:345

  const url = new URL("/auth/session", req.url)
  const response = (await Auth(
    new Request(url, { headers: req.headers }),
    options
  )) as Response

  const { status = 200 } = response

  const data = await response.json()
  const cookie = response.headers.get("set-cookie")
  if (!data || !Object.keys(data).length) {
    return { data: null, cookie }
  }
  if (status === 200) {
    return { data, cookie }
  }

  throw new Error(data.message)
}

export const setEnvDefaults = (env: EnvGetter, config: AuthConfig) => {
  if (!isServer) return
  config.basePath = "/auth"
  if (!config.secret?.length) {
    config.secret = []
    const secret = env.get("AUTH_SECRET")
    if (secret) {
      config.secret.push(secret)
    }
    for (const i of [1, 2, 3]) {
      const secret = env.get(`AUTH_SECRET_${i}`)
      if (secret) {
        config.secret.unshift(secret)
      }
    }
  }

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Inspect the thrown data.message for the underlying Auth.js core error.
2. Confirm the auth API routes are mounted at basePath /auth in the Qwik server and reachable at runtime.
3. Provide AUTH_SECRET (and AUTH_TRUST_HOST where needed) through Qwik's env getter.
4. Avoid calling session-dependent loaders during prerender/SSG; make them dynamic.

Example fix

// before
const { data } = await getSessionData(evt, overides) // throws on non-200
// after
try {
  const { data } = await getSessionData(evt, overides)
} catch (e) {
  console.error("Auth error:", (e as Error).message)
  return { data: null }
}

if (!process.env.AUTH_SECRET) throw new Error("AUTH_SECRET missing")
// Confirm the Qwik auth endpoints are reachable under /auth before rendering session-dependent UI.

function isSessionData(data: unknown): data is Record<string, unknown> {
  return typeof data === "object" && data !== null
}

try {
  const { data } = await getSessionData(requestEvent, overides)
} catch (err) {
  console.error("Auth.js error (Qwik):", (err as Error).message)
  // fall back to anonymous session
}

When it happens

Trigger: Invoking Qwik City's auth session loader / server$ call that hits /auth/session (or another auth action) while the backend returns a non-200 status — missing AUTH_SECRET, misconfigured basePath (Qwik sets basePath = "/auth" via setEnvDefaults), untrusted host, or an internal auth error.

Common situations: Qwik apps where auth route actions aren't mounted under /auth, so the fetch 404s; env vars not propagated to the Qwik server (EnvGetter misconfigured); calling session loaders during build/prerender when the auth server isn't reachable.

Related errors

• data.message
• data.message
• data.message
• Couldn't create session
• [createSession] Failed to fetch created session

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/c12b620b0c2b867b. Report an issue: GitHub.