nextauthjs/next-auth · error

Hasura client error: Please provide an adminSecret

Error message

Hasura client error: Please provide an adminSecret

What it means

The Hasura adapter client factory requires an adminSecret to authenticate GraphQL requests against Hasura with admin privileges. If the HasuraAdapter options omit adminSecret (or pass an empty string), client() throws this TypeError immediately at construction rather than failing later on 401 responses.

Source

Thrown at packages/adapter-hasura/src/lib/client.ts:27

   */
  adminSecret: string
}

export class HasuraClientError extends Error {
  name = "HasuraClientError"
  constructor(
    errors: any[],
    query: TypedDocumentString<any, any>,
    variables: any
  ) {
    super(errors.map((error) => error.message).join("\n"))
    console.error({ query, variables })
  }
}

export function client({ adminSecret, endpoint }: HasuraAdapterClient) {
  if (!adminSecret)
    throw new TypeError("Hasura client error: Please provide an adminSecret")

  if (!endpoint)
    throw new TypeError(
      "Hasura client error: Please provide a graphql endpoint"
    )

  return {
    async run<
      Q extends TypedDocumentString<any, any>,
      T extends Q extends TypedDocumentString<infer T, any> ? T : never,
      V extends Q extends TypedDocumentString<any, infer V> ? V : never,
    >(query: Q, variables?: V): Promise<T> {
      const response = await fetch(endpoint, {
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          "x-hasura-admin-secret": adminSecret,
        },

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Pass a non-empty adminSecret to HasuraAdapter options
2. Verify the environment variable (e.g. HASURA_ADMIN_SECRET) is set in the runtime environment and loaded (dotenv / platform config)
3. Log or assert the secret's presence at startup to fail fast with a clear message
4. If using JWT auth instead, use an adapter/auth configuration that does not require adminSecret

Example fix

// before
export const adapter = HasuraAdapter({ endpoint: process.env.HASURA_ENDPOINT! })
// after
export const adapter = HasuraAdapter({
  endpoint: process.env.HASURA_ENDPOINT!,
  adminSecret: process.env.HASURA_ADMIN_SECRET!,
})

if (!process.env.HASURA_ADMIN_SECRET) {
  throw new Error('HASURA_ADMIN_SECRET is not set')
}
const adapter = HasuraAdapter({
  endpoint: process.env.HASURA_ENDPOINT!,
  adminSecret: process.env.HASURA_ADMIN_SECRET,
})

function hasHasuraConfig(o: any): o is { adminSecret: string; endpoint: string } {
  return typeof o?.adminSecret === 'string' && o.adminSecret.length > 0
}

try {
  const adapter = HasuraAdapter({ adminSecret: process.env.HASURA_ADMIN_SECRET!, endpoint })
} catch (e) {
  if (e instanceof TypeError && e.message.includes('adminSecret')) {
    console.error('Set HASURA_ADMIN_SECRET in the environment')
  } else throw e
}

When it happens

Trigger: Instantiating HasuraAdapter({ endpoint }) without adminSecret, or with adminSecret: process.env.HASURA_ADMIN_SECRET when the env var is unset/empty (e.g., missing .env file, wrong env name, not loaded).

Common situations: Missing HASURA_ADMIN_SECRET in the deployment environment; env vars not loaded in Next.js server runtime; renaming the env var in Hasura Cloud but not in the app; passing the secret only client-side where it's stripped.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• Hasura client error: Please provide a graphql endpoint
• Object is nullish
• Must pass `secret` if not set to JWT getToken()
• Unsupported JWT Content Encryption Algorithm
• Invalid JWT

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/9db549a103e7d4e7. Report an issue: GitHub.