What causes "dsn must be set" in ory/kratos?

Set the dsn key in the kratos configuration file (e.g. DSN: postgres://...)

dsn must be set

Error message

dsn must be set

What it means

Config.DSN found neither 'memory' nor any non-empty DSN value in the active configuration, so no database connection string exists. This path calls l.Fatalf, so it terminates the process after printing a stack trace to aid debugging.

Solutions

Set the dsn key in the kratos configuration file (e.g. DSN: postgres://...)
Provide the DSN via the environment variable or CLI flag your deployment maps to ViperKeyDSN
Use 'memory' for local testing if a real database is not needed

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at driver/config/config.go:669 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/350c0bb5074311e8. Report an issue: GitHub.

Appendix: source

Thrown at driver/config/config.go:669

	}

	return ss, nil
}

func (p *Config) DSN(ctx context.Context) string {
	pp := p.GetProvider(ctx)
	dsn := pp.String(ViperKeyDSN)

	if dsn == "memory" {
		return DefaultSQLiteMemoryDSN
	}

	if len(dsn) > 0 {
		return dsn
	}

	// Print a stack trace to aid debugging.
	p.l.Fatalf("%+v", errors.Errorf("dsn must be set"))
	return ""
}

func (p *Config) DisableAPIFlowEnforcement(ctx context.Context) bool {
	if p.IsInsecureDevMode(ctx) && os.Getenv("DEV_DISABLE_API_FLOW_ENFORCEMENT") == "true" {
		p.l.Warn("Because \"DEV_DISABLE_API_FLOW_ENFORCEMENT=true\" and the \"--dev\" flag are set, self-service API flows will no longer check if the interaction is actually a browser flow. This is very dangerous as it allows bypassing of anti-CSRF measures, leaving the deployment highly vulnerable. This option should only be used for automated testing and never come close to real user data anywhere.")
		return true
	}
	return false
}

func (p *Config) ClientHTTPNoPrivateIPRanges(ctx context.Context) bool {
	return p.GetProvider(ctx).BoolF(ViperKeyClientHTTPNoPrivateIPRanges, false)
}

func (p *Config) ClientHTTPPrivateIPExceptionURLs(ctx context.Context) []string {
	return p.GetProvider(ctx).Strings(ViperKeyClientHTTPPrivateIPExceptionURLs)
}

View on GitHub (pinned to b86338da04)