nextauthjs/next-auth · error

No userinfo endpoint configured

Error message

No userinfo endpoint configured

What it means

handleOAuth throws this TypeError when neither the provider config nor the provider's discovered OIDC metadata supplies a userinfo endpoint, but the flow still needs to fetch the user profile. The library refuses to guess an endpoint and aborts the callback.

Source

Thrown at packages/core/src/lib/actions/callback/oauth/callback.ts:285

    }
  } else {
    if (userinfo?.request) {
      const _profile = await userinfo.request({ tokens, provider })
      if (_profile instanceof Object) profile = _profile
    } else if (userinfo?.url) {
      const userinfoResponse = await o.userInfoRequest(
        as,
        client,
        processedCodeResponse.access_token,
        {
          [o.customFetch]: provider[customFetch],
          // TODO: move away from allowing insecure HTTP requests
          [o.allowInsecureRequests]: true,
        }
      )
      profile = await userinfoResponse.json()
    } else {
      throw new TypeError("No userinfo endpoint configured")
    }
  }

  if (tokens.expires_in) {
    tokens.expires_at =
      Math.floor(Date.now() / 1000) + Number(tokens.expires_in)
  }

  const profileResult = await getUserAndAccount(
    profile,
    provider,
    tokens,
    logger
  )

  return { ...profileResult, profile, cookies: resCookies }
}

View on GitHub (pinned to a1a16a5a77)

Solutions

1. Add the `userinfo` URL to the provider config (e.g. userinfo: "https://api.example.com/user").
2. Or set `wellKnown` to the issuer's discovery document so userinfo_endpoint is discovered automatically.
3. If the provider has no userinfo endpoint at all, switch to an OIDC provider config whose id_token carries the needed claims.
4. Verify the discovery URL returns valid metadata containing userinfo_endpoint.

Example fix

// before
const GitHub = {
  id: "github",
  type: "oauth",
  authorization: "https://github.com/login/oauth/authorize",
  token: "https://github.com/login/oauth/access_token",
}
// after
const GitHub = {
  id: "github",
  type: "oauth",
  authorization: "https://github.com/login/oauth/authorize",
  token: "https://github.com/login/oauth/access_token",
  userinfo: "https://api.github.com/user",
}

const provider = { id: "custom", type: "oauth", userinfo: undefined }
if (!provider.userinfo && !provider.wellKnown) {
  throw new Error("Provider needs `userinfo` or a discoverable `wellKnown` URL")
}

function hasUserinfo(p: { userinfo?: string; wellKnown?: string }): boolean {
  return typeof p.userinfo === "string" || typeof p.wellKnown === "string"
}

When it happens

Trigger: A custom/generic OAuth provider is defined without `userinfo` set, `wellKnown` discovery is absent or fails to include userinfo_endpoint, and `id_token` either lacks required claims or the flow proceeds to fetch profile — reaching the `else` branch that throws.

Common situations: Hand-rolled provider configs copied from old NextAuth examples that omitted `userinfo`; OAuth2 providers that only return an id_token and define no userinfo route; typo in `wellKnown` URL so discovery metadata is missing.

Related errors

• TODO: Authorization server did not provide a token endpoint.
• TODO: Authorization server did not provide a userinfo endpoi
• unsupported client authentication method
• State data was provided but the provider is not configured t
• Discovery request responded with an invalid issuer. expected

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/7c19e30e047f0ba0. Report an issue: GitHub.