nextauthjs/next-auth · error · InvalidCheck

${name} value could not be parsed

Error message

${name} value could not be parsed

What it means

The catch-all of parseCookie: any failure in decoding or validating the check cookie (missing, undecodable, wrong provider) is rethrown as InvalidCheck("<name> value could not be parsed") with the original error as `cause`. It normalizes all cookie parse failures into one error type.

Source

Thrown at packages/core/src/lib/actions/callback/oauth/checks.ts:84

    logger.debug(`PARSE_${name.toUpperCase()}`, { cookie: value })

    if (!value) throw new InvalidCheck(`${name} cookie was missing`)
    const parsed = await decode<CookiePayload>({
      ...jwt,
      token: value,
      salt: cookies[name].name,
    })
    if (!parsed?.value) throw new Error("Invalid cookie")
    // The check must have been created by the provider currently handling
    // the callback.
    if (parsed.provider !== options.provider?.id) {
      throw new Error(
        `${name} cookie was created for a different provider than the one handling the callback`
      )
    }
    return parsed.value
  } catch (error) {
    throw new InvalidCheck(`${name} value could not be parsed`, {
      cause: error,
    })
  }
}

function clearCookie(
  name: keyof CookiesOptions,
  options: InternalOptions,
  resCookies: Cookie[]
) {
  const { logger, cookies } = options
  const cookie = cookies[name]
  logger.debug(`CLEAR_${name.toUpperCase()}`, { cookie })
  resCookies.push({
    name: cookie.name,
    value: "",
    options: { ...cookies[name].options, maxAge: 0 },
  })

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Inspect error.cause to find the real reason (decode failure vs provider mismatch).
2. Use one fixed AUTH_SECRET shared by every server instance and persist it across deploys.
3. Retry the sign-in flow to get a fresh cookie set.
4. Check middleware/proxies for cookie mutation or size truncation.

if (!process.env.AUTH_SECRET) throw new Error("Set a stable AUTH_SECRET")

try {
  await auth()
} catch (e) {
  if (e?.message?.endsWith("value could not be parsed")) {
    console.error("Check cookie failed:", e.cause) // inspect real cause
  }
}

When it happens

Trigger: Any underlying throw inside parseCookie — JWT decode failure with the configured secret/salt, "Invalid cookie", provider mismatch, or decode() rejecting — is wrapped and rethrown with this message.

Common situations: Same as underlying causes: rotated/mismatched AUTH_SECRET across instances, corrupted or truncated cookies, cross-provider callback, expired/invalidated in-flight flows after a deploy.

Related errors

• Invalid cookie
• ${name} cookie was missing
• ${name} cookie was created for a different provider than the
• Invalid state
• Account not created

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/8cac7ee0a5aa516d. Report an issue: GitHub.