SECURITY WARNING: Never run commands you don't understand. Always review code before execution. Use at your own risk.
FixMyError.net
Auth New Added 26 October 2026

Auth.js: UntrustedHost: Host must be trusted. URL was: http://localhost:3000

Auth.js (NextAuth v5) will not build callback URLs from a Host header it has not been told to trust, which protects against host header injection. On Vercel and under next dev it trusts the host automatically, so the error first appears with next start, in Docker or behind your own reverse proxy. Version 4 sidestepped the question with NEXTAUTH_URL. In v5 you either set AUTH_URL or say the proxy in front can be trusted with AUTH_TRUST_HOST.

Quick fix

Read the commands before running them. Anything that restarts a service, deletes data or changes permissions should be tried on a non-production system first.

Quick fix
# Do the variables reach the running server, not just the build?
docker exec my-app printenv | grep -E "^(AUTH|NEXTAUTH)_"

# Upgrading from v4: NEXTAUTH_URL and NEXTAUTH_SECRET become AUTH_URL and AUTH_SECRET
grep -rn "NEXTAUTH_" .env* 2>/dev/null

# Behind a proxy or in a container you control, trust the forwarded host
echo 'AUTH_TRUST_HOST=true' >> .env.production
# or pin the public URL
echo 'AUTH_URL=https://app.example.com' >> .env.production

# Or in code, auth.ts:
# export const { handlers, auth } = NextAuth({ trustHost: true, providers: [...] })

# The proxy must pass the real host and scheme (nginx)
# proxy_set_header Host $host;
# proxy_set_header X-Forwarded-Proto $scheme;

How to diagnose Auth errors

Identity errors are almost always configuration mismatches between two systems rather than code bugs: a redirect URI registered with a trailing slash, a client secret that was rotated on one side only, a clock that has drifted past the token skew allowance. Because the identity provider deliberately returns vague errors to avoid leaking information to attackers, the provider's own log is usually far more informative than the message your application receives.

If the quick fix above does not resolve it, work through these steps. They apply to this whole class of error, not just to this one message, which is usually what saves the time.

  1. Open the identity provider's log or event stream first. Auth0, Okta and Keycloak all record a detailed reason that they never send back to the client.
  2. Compare the redirect URI byte for byte, including scheme, port and trailing slash. http://localhost:3000/callback and http://localhost:3000/callback/ are different URIs.
  3. Decode the token rather than guessing. Paste it into a local JWT decoder and check iss, aud, exp and nbf, never a remote paste site, because tokens are credentials.
  4. Check clock skew with timedatectl or ntpq -p. Kerberos, SAML and JWT all reject tokens outside a tight time window, and a drifting VM clock produces intermittent, unreproducible auth failures.
  5. For passkeys and WebAuthn, verify the Relying Party ID matches the origin exactly and that the page is served over HTTPS or on localhost. Nothing else is a secure context.

Tools worth reaching for

  • Provider audit logs
  • jwt decoding (locally)
  • openssl x509 -noout -text
  • browser devtools network tab

Authoritative references

Primary documentation for this error, worth reading before applying any fix in production.

authjs.dev errors.authjs.dev

Related Auth errors

See all 20 Auth errors →

Browse other categories

Something missing or wrong?

This entry is maintained by hand. If the fix is out of date, incomplete, or you have a better one, email a correction and it will be reviewed.