Auth.js · server log
JWTSessionError
[auth][error] JWTSessionError: Read more at https://errors.authjs.dev#jwtsessionerror [auth][cause]: Error: no matching decryption secretWhat it means
With strategy "jwt", Auth.js couldn't decrypt the session cookie. The cookie was encrypted with a different secret, so it's destroyed and the user is signed out.
Common causes
- AUTH_SECRET changed (or differs between preview and production)
- An old cookie from another app on localhost:3000
How to fix it
- For one user: clear cookies for the site and sign in again
- To rotate without signing everyone out, set the new secret as AUTH_SECRET and keep the old one as AUTH_SECRET_1 for a while
- Use the same secret on every deployment that shares the domain
Prompt for Cursor or Claude Code
Auth.js logs JWTSessionError: no matching decryption secret. Check whether AUTH_SECRET differs between environments and set up AUTH_SECRET_1 rotation if I changed it on purpose.Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Auth.js error fixer.
next: skip the next one
Skip the setup. The VibeBoot SaaS Starter ships Auth.js v5 already wired (GitHub sign-in, optional email magic links, Prisma adapter), plus Stripe and a database on Next.js 16.4.3. $49, one-time.
14-day money-back guarantee · lifetime updates
Other Auth.js errors
$ fixed it? get the next one first
New fixes for what AI agents break, by email.
When we add a fix or a Cursor rule for a new Next.js, Auth.js, Prisma or Stripe break, it goes out in the VibeBoot newsletter. Free, occasional, unsubscribe in one click.