Auth.js · server log

UntrustedHost

[auth][error] UntrustedHost: Host must be trusted. URL was: https://your-app.com/api/auth/session. Read more at https://errors.authjs.dev#untrustedhost

What it means

Auth.js builds callback URLs from the request's Host header and refuses to trust it by default in production. In development (NODE_ENV not production) it trusts the host automatically, which is why this only appears after you deploy.

Common causes

• Running next start, Docker, Railway, Fly, Render or a VPS behind a proxy
• Vercel and Cloudflare Pages are detected automatically (VERCEL / CF_PAGES env vars), most other hosts are not

How to fix it

1. Set trustHost: true in your NextAuth config, or
2. Set AUTH_TRUST_HOST=true in the production environment
3. Setting AUTH_URL also counts as trusting the host

export const { handlers, auth, signIn, signOut } = NextAuth({
  trustHost: true, // needed for next start, Docker and most non-Vercel hosts
  providers: [GitHub],
});

Prompt for Cursor or Claude Code

Auth.js logs UntrustedHost after deploying with next start. Add trustHost: true to the NextAuth config in auth.ts (or tell me to set AUTH_TRUST_HOST=true on the host) and explain why it worked locally.

Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Auth.js error fixer.