What causes "Must pass `req` to JWT getToken()" in nextauthjs/next-auth?

Pass the incoming request object: getToken({ req, secret, ... })

Must pass `req` to JWT getToken()

Error message

Must pass `req` to JWT getToken()

What it means

getToken() (the JWT module's helper for reading a session token outside route handlers) requires a `req` object to locate the token cookie or Authorization header. If params.req is missing, it throws immediately. Auth.js derives request info — headers, cookies, secure-cookie context — entirely from req, so it cannot proceed without it.

Source

Thrown at packages/core/src/jwt.ts:161

 */
export async function getToken<R extends boolean = false>(
  params: GetTokenParams<R>
): Promise<R extends true ? string : JWT | null>
export async function getToken(
  params: GetTokenParams
): Promise<string | JWT | null> {
  const {
    secureCookie,
    cookieName = defaultCookies(secureCookie ?? false).sessionToken.name,
    decode: _decode = decode,
    salt = cookieName,
    secret,
    logger = console,
    raw,
    req,
  } = params

  if (!req) throw new Error("Must pass `req` to JWT getToken()")

  const headers =
    req.headers instanceof Headers ? req.headers : new Headers(req.headers)

  const sessionStore = new SessionStore(
    { name: cookieName, options: { secure: secureCookie } },
    parseCookie(headers.get("cookie") ?? ""),
    logger
  )

  let token = sessionStore.value

  const authorizationHeader = headers.get("authorization")

  if (!token && authorizationHeader?.split(" ")[0] === "Bearer") {
    const urlEncodedToken = authorizationHeader.split(" ")[1]
    try {
      token = decodeURIComponent(urlEncodedToken)

View on GitHub (pinned to a1a16a5a77)

Solutions

Pass the incoming request object: getToken({ req, secret, ... })
In App Router, construct req-compatible params or use auth()/getServerSession instead of getToken
In middleware, pass the NextRequest as req
If you only have a token string, decode with jwtDecode/decode directly instead of getToken

Example fix

// before
const token = await getToken({ secret: process.env.AUTH_SECRET })
// after
import { getToken } from 'next-auth/jwt'
const token = await getToken({ req, secret: process.env.AUTH_SECRET })

Defensive patterns

Strategy: validation

Validate before calling

if (!req) throw new Error('getToken requires req — pass the incoming request')
const token = await getToken({ req, secret: process.env.AUTH_SECRET })

Type guard

function hasReq(p: { req?: unknown }): p is { req: Request | { headers: Record<string, string> } } {
  return p.req != null
}

Try / catch

try {
  const token = await getToken({ req, secret })
  return token
} catch (e) {
  if (e.message.includes('Must pass `req`')) {
    console.error('getToken called without req — pass the request object')
  }
  throw e
}

Prevention

Always pass req (NextRequest/NextApiRequest) to getToken
In App Router, prefer auth()/getServerSession over getToken where possible
Only have a raw token string? Use decode/jwtDecode instead of getToken

When it happens

Trigger: Calling getToken({ secret }) without req; passing a NextApiRequest-like object where req was destructured away; invoking getToken in middleware/edge code with only the cookie string instead of a request; upgrading versions where the API contract changed to require req.

Common situations: Reading the session in a standalone API route or getServerSideProps and forgetting to pass req; passing res instead of req; custom server code calling getToken directly; examples copied from old docs (some versions accepted req OR token cookies differently).

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/db6244583ec5439c. Report an issue: GitHub.