Auth.js · server log
MissingSecret
[auth][error] MissingSecret: Please define a `secret`. Read more at https://errors.authjs.dev#missingsecretWhat it means
Auth.js has no secret to encrypt cookies and tokens with. It reads AUTH_SECRET (or AUTH_SECRET_1, _2, _3 for rotation). next-auth v5 still falls back to the old NEXTAUTH_SECRET.
Common causes
- AUTH_SECRET is in .env.local but not in your host's environment variables
- The variable was added after the last deploy, so the running build doesn't see it
- A typo like AUTH_SECRETS or NEXT_PUBLIC_AUTH_SECRET
How to fix it
- Generate one: npx auth secret (or openssl rand -base64 33)
- Add AUTH_SECRET to the production environment on your host
- Redeploy so the new value is picked up
- Never prefix it with NEXT_PUBLIC_: that ships it to the browser
# at least 32 random characters
AUTH_SECRET="paste-the-output-of-npx-auth-secret"Prompt for Cursor or Claude Code
Auth.js throws MissingSecret in production. Check which env vars my auth.ts reads, confirm AUTH_SECRET is set for the production environment on my host (not only in .env.local), and make sure it is never exposed with a NEXT_PUBLIC_ prefix.Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Auth.js error fixer.
next: skip the next one
Skip the debugging. The VibeBoot SaaS Starter ships with this already handled: src/auth.ts sets trustHost and ships GitHub sign-in, and .env.example documents AUTH_SECRET and the GitHub callback URL. Plus Stripe and a database on Next.js 16.4.3. $49, one-time.
14-day money-back guarantee · lifetime updates
Other Auth.js errors
$ fixed it? get the next one first
New fixes for what AI agents break, by email.
When we add a fix or a Cursor rule for a new Next.js, Auth.js, Prisma or Stripe break, it goes out in the VibeBoot newsletter. Free, occasional, unsubscribe in one click.