Skip to main content
Achromatic
Live demo
General
Troubleshooting

Authentication

Learn about authentication troubles and their solutions.

Open MarkdownFull AI corpusFeedback

Start with the first server-side error produced by the failed request. Browser messages such as Failed to fetch often hide a database, environment or OAuth configuration error logged by the server.

Sign-up or sign-in fails

Check the shared prerequisites before changing authentication code:

  1. Confirm the root .env contains a valid DATABASE_URL and a non-empty BETTER_AUTH_SECRET.
  2. Apply the committed schema with npm run db:migrate.
  3. Restart npm run dev after changing environment variables.
  4. Reproduce the request while watching the terminal that runs Next.js.

Use a unique BETTER_AUTH_SECRET in every deployed environment. Do not copy the development value from .env.example into production.

Production redirects to localhost

Better Auth receives its baseURL in lib/auth/index.ts. The value comes from getBaseUrl() in lib/utils.ts in this order:

  1. A Vercel branch URL for a non-staging Preview deployment.
  2. NEXT_PUBLIC_SITE_URL.
  3. Vercel's generated deployment URL.
  4. http://localhost:3000 when none of the values above exist.

Set NEXT_PUBLIC_SITE_URL to the final HTTPS production origin, without a path or trailing route, then redeploy. Confirm the variable exists in the Production environment rather than only Development or Preview.

Google OAuth returns a callback error

Verify the configuration as one complete set:

  1. Set both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in the environment where the deployment runs.
  2. Register the exact callback URL https://yourdomain.com/api/auth/callback/google in Google Cloud.
  3. Register the matching application origin.
  4. Keep enableSocialLogin enabled in config/auth.config.ts only when the credentials are ready.
  5. Confirm google remains in lib/auth/oauth-providers.tsx and in the socialProviders configuration in lib/auth/index.ts.

Google compares callback URLs exactly. Scheme, hostname, port and path must all match. A Vercel branch preview can use a different hostname from production, so register that exact preview callback or test OAuth on a stable staging domain.

Use the OAuth setup guide to generate the callback URL for each environment.

Request rejected because of its origin

config/auth.config.ts builds Better Auth's trusted origins from getBaseUrl(), the configured site URL and Vercel deployment URLs. If a custom frontend origin calls the auth API, add that exact HTTPS origin deliberately. Do not use a broad wildcard for production origins.

After changing trusted origins, restart or redeploy the application and test sign-in, sign-out and an authenticated request from the intended frontend.