ory/hydra · error

the provided region is not allowed by this project's home re

Error message

the provided region is not allowed by this project's home region

What it means

ErrNotAllowed is wrapped when a valid, known region is nonetheless outside the project's allowed home_region constraint. NewErrNotAllowed() produces a herodot 400 wrapping this sentinel so errors.Is works on the client side. Unlike ErrInvalid, the region exists — the project just may not use it.

Source

Thrown at oryx/region/region.go:123

// IsEqual compares two nullable *Region pointers (both nil = equal).
func IsEqual(a, b *Region) bool {
	if a == nil && b == nil {
		return true
	}
	if a == nil || b == nil {
		return false
	}
	return *a == *b
}

// ErrInvalid is wrapped when a submitted region is not a known value.
// Use NewErrInvalid for a herodot 400; use errors.Is for chain checks.
var ErrInvalid = errors.New("the provided region is not a valid Ory region")

// ErrNotAllowed is wrapped when a valid region is outside the project's
// home_region constraint.
var ErrNotAllowed = errors.New("the provided region is not allowed by this project's home region")

// NewErrInvalid returns a fresh herodot 400 wrapping ErrInvalid.
func NewErrInvalid() error {
	return errors.WithStack(
		herodot.ErrBadRequest().
			WithReason(ErrInvalid.Error()).
			WithDebug(`region must be one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global`).
			WithWrap(ErrInvalid),
	)
}

// NewErrNotAllowed returns a fresh herodot 400 wrapping ErrNotAllowed.
func NewErrNotAllowed() error {
	return errors.WithStack(
		herodot.ErrBadRequest().
			WithReason(ErrNotAllowed.Error()).
			WithWrap(ErrNotAllowed),
	)

View on GitHub (pinned to 4174065ffb)

Solutions

1. Use the project's configured home_region instead of the requested one
2. Update the project's home_region setting if the new region is genuinely required
3. Route the request to the project's home region endpoint rather than a local region
4. Handle errors.Is(err, region.ErrNotAllowed) in clients to surface an actionable message

Example fix

// before
client.WithRegion(region.EUCentral)
// after
client.WithRegion(project.HomeRegion) // respect the project's home_region constraint

if region.IsValid(submittedRegion) && submittedRegion != project.HomeRegion {
	// region exists but not allowed for this project
}

func isRegionNotAllowedErr(err error) bool {
	return errors.Is(err, region.ErrNotAllowed)
}

if err := call(reg); err != nil {
	if errors.Is(err, region.ErrNotAllowed) {
		return fmt.Errorf("region %s not allowed; project home region is %s", reg, project.HomeRegion)
	}
	return err
}

When it happens

Trigger: Submitting a known region value (region.Validate passes) but the project is pinned to a different home_region, so the requested region is rejected by the project's constraint check.

Common situations: Deploying a workload into a region different from the project's home region; copy-pasting configuration between projects with different home regions; switching a project's region without updating dependent services.

Related errors

• the provided region is not a valid Ory region
• cookiex: purpose must be non-empty and must not contain a pi
• cookiex: at least one secret is required
• file loader disabled
• http(s) loader disabled

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/de21f959b7ecc81e. Report an issue: GitHub.