What causes "the provided region is not a valid Ory region" in ory/hydra?

Use a region constant/type from the region package instead of a raw string literal

the provided region is not a valid Ory region

Error message

the provided region is not a valid Ory region

What it means

ErrInvalid is the sentinel wrapped when a submitted region string is not a recognized Ory region value. The package offers NewErrInvalid() which wraps it in a herodot 400 for HTTP responses, while errors.Is can be used to detect it in code. It signals input validation failure on a region/home-region field.

Source

Thrown at oryx/region/region.go:119

// Value implements driver.Valuer. The empty Region writes as "".
func (r Region) Value() (driver.Value, error) {
	return string(r), nil
}

// IsEqual compares two nullable *Region pointers (both nil = equal).
func IsEqual(a, b *Region) bool {
	if a == nil && b == nil {
		return true
	}
	if a == nil || b == nil {
		return false
	}
	return *a == *b
}

// ErrInvalid is wrapped when a submitted region is not a known value.
// Use NewErrInvalid for a herodot 400; use errors.Is for chain checks.
var ErrInvalid = errors.New("the provided region is not a valid Ory region")

// ErrNotAllowed is wrapped when a valid region is outside the project's
// home_region constraint.
var ErrNotAllowed = errors.New("the provided region is not allowed by this project's home region")

// NewErrInvalid returns a fresh herodot 400 wrapping ErrInvalid.
func NewErrInvalid() error {
	return errors.WithStack(
		herodot.ErrBadRequest().
			WithReason(ErrInvalid.Error()).
			WithDebug(`region must be one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global`).
			WithWrap(ErrInvalid),
	)
}

// NewErrNotAllowed returns a fresh herodot 400 wrapping ErrNotAllowed.
func NewErrNotAllowed() error {
	return errors.WithStack(

View on GitHub (pinned to 4174065ffb)

Solutions

Use a region constant/type from the region package instead of a raw string literal
Validate the region input with region.Validate before persisting or calling APIs
Check the exact accepted region identifiers for the Ory platform version in use and update config
Return NewErrInvalid() in handlers so clients get a proper 400 with the reason

Example fix

// before
cfg.Set("home_region", "us-central")
// after
cfg.Set("home_region", string(region.USCentral)) // use the package's canonical region value

Defensive patterns

Strategy: validation

Validate before calling

if err := region.Validate(submittedRegion); err != nil {
	// reject input before calling further APIs
}

Type guard

func isRegionInvalidErr(err error) bool {
	return errors.Is(err, region.ErrInvalid)
}

Try / catch

if err := doSomethingWithRegion(r); err != nil {
	if errors.Is(err, region.ErrInvalid) {
		return herodot.ErrBadRequest().WithReason("unknown region")
	}
	return err
}

Prevention

Use the package's region constants/types, never free-form strings
Validate region input at the API boundary before persisting it
Keep region name lists in sync with the platform version you deploy

When it happens

Trigger: Calling region.Validate (or any API accepting a region field) with a string that is not in the known region set — e.g. a typo, empty string, lowercase mismatch, or a region from a different cloud provider's naming scheme.

Common situations: Misconfigured project home_region in config files; stale region names after the provider renames/retires a region; user-supplied region values passed through from an API request without validation; hardcoding a region in infrastructure-as-code with a typo.

Related errors

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/e0d7965aab61b2e0. Report an issue: GitHub.