Auth.js · server log

MissingCSRF

[auth][error] MissingCSRF: CSRF token was missing during an action signin. Read more at https://errors.authjs.dev#missingcsrf

What it means

A sign-in or sign-out POST arrived without Auth.js's CSRF cookie and token. Often it's a hand-rolled fetch to /api/auth/signin instead of the provided helpers.

Common causes

• fetch('/api/auth/signin/…', { method: 'POST' }) written by hand
• A form posting to the Auth.js endpoint from another origin

How to fix it

1. Use signIn() from your auth.ts in a Server Action, or signIn from next-auth/react in a Client Component
2. Don't call the /api/auth endpoints directly

import { signIn } from "@/auth";

<form action={async () => { "use server"; await signIn("github", { redirectTo: "/dashboard" }); }}>
  <button>Sign in with GitHub</button>
</form>

Prompt for Cursor or Claude Code

Auth.js logs MissingCSRF. Find any hand-written fetch or form that posts to /api/auth/* and replace it with signIn() from auth.ts in a Server Action.

Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Auth.js error fixer.