transloadit/uppy · critical · Error

uploadUrls is required

Error message

uploadUrls is required

What it means

Companion requires uploadUrls (the allowlist of origins allowed to upload through it) when NODE_ENV=production, because running without it is a security risk (open upload proxy). In development it only logs an error.

Source

Thrown at packages/@uppy/companion/src/config/companion.ts:132

  if (providerOptions) {
    const deprecatedOptions: Record<string, string> = {
      microsoft: 'providerOptions.onedrive',
      google: 'providerOptions.drive',
      s3: 's3',
    }
    Object.keys(deprecatedOptions).forEach((deprecated) => {
      if (Object.hasOwn(providerOptions, deprecated)) {
        throw new Error(
          `The Provider option "providerOptions.${deprecated}" is no longer supported. Please use the option "${deprecatedOptions[deprecated]}" instead.`,
        )
      }
    })
  }

  if (uploadUrls == null || uploadUrls.length === 0) {
    if (process.env['NODE_ENV'] === 'production') {
      throw new Error('uploadUrls is required')
    }
    logger.error(
      'Running without uploadUrls is a security risk and Companion will refuse to start up when running in production (NODE_ENV=production)',
      'startup.uploadUrls',
    )
  }

  const { corsOrigins } = companionOptions
  if (corsOrigins == null) {
    throw new TypeError(
      'Option corsOrigins is required. To disable security, pass true',
    )
  }

  if (corsOrigins === '*') {
    throw new TypeError(
      'Option corsOrigins cannot be "*". To disable security, pass true',
    )

View on GitHub (pinned to 5d4dedd02a)

Solutions

1. Add uploadUrls: ['https://your-app.example.com'] to companionOptions
2. Include every origin that embeds Uppy and uploads through Companion
3. Test with NODE_ENV=production locally to catch this before deploying

Example fix

// before
companion.app({ providerOptions, server, filePath })

// after
companion.app({ providerOptions, server, filePath, uploadUrls: ['https://app.example.com'] })

if (process.env.NODE_ENV === 'production' && (!uploadUrls || uploadUrls.length === 0)) throw new Error('uploadUrls required in production')

const hasUploadUrls = (o: { uploadUrls?: string[] }) => Array.isArray(o.uploadUrls) && o.uploadUrls.length > 0

null

When it happens

Trigger: Starting Companion with NODE_ENV=production and no uploadUrls array (or an empty one) in companionOptions.

Common situations: Deploying to production with a dev-oriented config; forgetting to port uploadUrls from the old protocol/domain options when upgrading; environment variable not set in non-prod so the misconfiguration goes unnoticed until deploy.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• If you want to use '/' as server.path, leave the 'path' vari
• Option corsOrigins is required. To disable security, pass tr
• Option corsOrigins cannot be "*". To disable security, pass
• File data is missing for file ${options.file.id}
• Missing S3 object key for completing multipart upload

AI-assisted analysis of transloadit/uppy@5d4dedd02a (2026-08-28). Data as JSON: /api/errors/e0ded08ee8d6370b. Report an issue: GitHub.