[GH-ISSUE #1342] oidc login error if refresh expires is 0

kerem commented

2026-02-26 18:46:45 +03:00

Owner

Originally created by @charlyschulte on GitHub (Sep 10, 2024).
Original GitHub issue: https://github.com/documenso/documenso/issues/1342

Originally assigned to: @ephraimduncan on GitHub.

Issue Description

i get the error: Unknown argument refresh_expires_in. Available options are marked with ?.
i think because my refresh token never expires and therefore is 0

Steps to Reproduce

No response

Expected Behavior

0 should be a valid in refresh_expires_in

Current Behavior

No response

Screenshots (optional)

No response

Operating System [e.g., Windows 10]

No response

Browser [e.g., Chrome, Firefox]

No response

Version [e.g., 2.0.1]

No response

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @charlyschulte on GitHub (Sep 10, 2024). Original GitHub issue: https://github.com/documenso/documenso/issues/1342 Originally assigned to: @ephraimduncan on GitHub. ### Issue Description i get the error: Unknown argument `refresh_expires_in`. Available options are marked with ?. i think because my refresh token never expires and therefore is 0 ### Steps to Reproduce _No response_ ### Expected Behavior 0 should be a valid in refresh_expires_in ### Current Behavior _No response_ ### Screenshots (optional) _No response_ ### Operating System [e.g., Windows 10] _No response_ ### Browser [e.g., Chrome, Firefox] _No response_ ### Version [e.g., 2.0.1] _No response_ ### Please check the boxes that apply to this issue report. - [X] I have searched the existing issues to make sure this is not a duplicate. - [X] I have provided steps to reproduce the issue. - [X] I have included relevant environment information. - [X] I have included any relevant screenshots. - [X] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [X] I want to work on creating a PR for this issue if approved

kerem

2026-02-26 18:46:45 +03:00

closed this issue
added the
status: triage
label

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Sep 10, 2024):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

@github-actions[bot] commented on GitHub (Sep 10, 2024): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@zvn2060 commented on GitHub (Oct 25, 2024):

Doesn't this cause by missing field in Prisma schema?
github.com/documenso/documenso@b8310237e4/packages/prisma/schema.prisma (L242-L263)

I encountered same error, but the refresh_expires_in is 1800

@zvn2060 commented on GitHub (Oct 25, 2024): Doesn't this cause by missing field in Prisma schema? https://github.com/documenso/documenso/blob/b8310237e4589c128970cb0cdaeebd8862acf160/packages/prisma/schema.prisma#L242-L263 I encountered same error, but the `refresh_expires_in` is 1800

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 14, 2024):

🚨 Documenso Police 🚨

@ephraimduncan has 6 open issues assigned already. Consider whether this issue should be assigned to them or left open for another contributor.

@github-actions[bot] commented on GitHub (Nov 14, 2024): ### 🚨 Documenso Police 🚨 @ephraimduncan has 6 open issues assigned already. Consider whether this issue should be assigned to them or left open for another contributor.

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@celevra commented on GitHub (Feb 5, 2025):

same issue here

documenso-documenso-1  | [next-auth][error][OAUTH_CALLBACK_HANDLER_ERROR] 
documenso-documenso-1  | https://next-auth.js.org/errors#oauth_callback_handler_error 
documenso-documenso-1  | Invalid `prisma.account.create()` invocation:
documenso-documenso-1  | 
documenso-documenso-1  | {
documenso-documenso-1  |   data: {
documenso-documenso-1  |     provider: "oidc",
documenso-documenso-1  |     type: "oauth",
documenso-documenso-1  |     providerAccountId: "ce2f22a9-3651-4041-90c7-2c2c9bf43758",
documenso-documenso-1  |     access_token: "xxx",
documenso-documenso-1  |     expires_at: 1738768001,
documenso-documenso-1  |     refresh_expires_in: 1800,
documenso-documenso-1  |     ~~~~~~~~~~~~~~~~~~
documenso-documenso-1  |     refresh_token: "xxx,
documenso-documenso-1  |     token_type: "Bearer",
documenso-documenso-1  |     id_token: "xxx",
documenso-documenso-1  |     not-before-policy: 0,
documenso-documenso-1  |     session_state: "432aba57-49d5-404a-94ee-34fd8a221ded",
documenso-documenso-1  |     scope: "openid profile email",
documenso-documenso-1  |     userId: 3,
documenso-documenso-1  | ?   id?: String,
documenso-documenso-1  | ?   created_at?: Int | Null,
documenso-documenso-1  | ?   ext_expires_in?: Int | Null,
documenso-documenso-1  | ?   user?: UserCreateNestedOneWithoutAccountsInput
documenso-documenso-1  |   }
documenso-documenso-1  | }
documenso-documenso-1  | 
documenso-documenso-1  | Unknown argument `refresh_expires_in`. Available options are marked with ?. PrismaClientValidationError:

@celevra commented on GitHub (Feb 5, 2025): same issue here ``` documenso-documenso-1 | [next-auth][error][OAUTH_CALLBACK_HANDLER_ERROR] documenso-documenso-1 | https://next-auth.js.org/errors#oauth_callback_handler_error documenso-documenso-1 | Invalid `prisma.account.create()` invocation: documenso-documenso-1 | documenso-documenso-1 | { documenso-documenso-1 | data: { documenso-documenso-1 | provider: "oidc", documenso-documenso-1 | type: "oauth", documenso-documenso-1 | providerAccountId: "ce2f22a9-3651-4041-90c7-2c2c9bf43758", documenso-documenso-1 | access_token: "xxx", documenso-documenso-1 | expires_at: 1738768001, documenso-documenso-1 | refresh_expires_in: 1800, documenso-documenso-1 | ~~~~~~~~~~~~~~~~~~ documenso-documenso-1 | refresh_token: "xxx, documenso-documenso-1 | token_type: "Bearer", documenso-documenso-1 | id_token: "xxx", documenso-documenso-1 | not-before-policy: 0, documenso-documenso-1 | session_state: "432aba57-49d5-404a-94ee-34fd8a221ded", documenso-documenso-1 | scope: "openid profile email", documenso-documenso-1 | userId: 3, documenso-documenso-1 | ? id?: String, documenso-documenso-1 | ? created_at?: Int | Null, documenso-documenso-1 | ? ext_expires_in?: Int | Null, documenso-documenso-1 | ? user?: UserCreateNestedOneWithoutAccountsInput documenso-documenso-1 | } documenso-documenso-1 | } documenso-documenso-1 | documenso-documenso-1 | Unknown argument `refresh_expires_in`. Available options are marked with ?. PrismaClientValidationError: ```

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@celevra commented on GitHub (Feb 5, 2025):

ok i'm not a next.js or prisma expert, but i've change ext_expires_in to refresh_expires_in because to comment above was

// Stops next-auth from crashing when dealing with AzureAD

after the change it goes a step further but only until the next variable

documenso-documenso-1  | Invalid `prisma.account.create()` invocation:
documenso-documenso-1  |
documenso-documenso-1  | {
documenso-documenso-1  |   data: {
documenso-documenso-1  |     provider: "oidc",
documenso-documenso-1  |     type: "oauth",
documenso-documenso-1  |     providerAccountId: "ce2f22a9-3651-4041-90c7-2c2c9bf43758",
documenso-documenso-1  |     access_token: "xxx",
documenso-documenso-1  |     expires_at: 1738782434,
documenso-documenso-1  |     refresh_expires_in: 1800,
documenso-documenso-1  |     refresh_token: "xxx",
documenso-documenso-1  |     token_type: "Bearer",
documenso-documenso-1  |     id_token: "xxx",
documenso-documenso-1  |     not-before-policy: 0,
documenso-documenso-1  |     ~~~~~~~~~~~~~~~~~
documenso-documenso-1  |     session_state: "d4518b2a-c36a-40b1-9a1b-bd3c0ebd9775",
documenso-documenso-1  |     scope: "openid profile email",
documenso-documenso-1  |     userId: 3,
documenso-documenso-1  | ?   id?: String,
documenso-documenso-1  | ?   created_at?: Int | Null,
documenso-documenso-1  | ?   user?: UserCreateNestedOneWithoutAccountsInput
documenso-documenso-1  |   }
documenso-documenso-1  | }
documenso-documenso-1  |
documenso-documenso-1  | Unknown argument `not-before-policy`. Available options are marked with ?.
documenso-documenso-1  |     at En (/app/node_modules/@prisma/client/runtime/library.js:116:5888)
documenso-documenso-1  |     at Cn.handleRequestError (/app/node_modules/@prisma/client/runtime/library.js:123:6516)
documenso-documenso-1  |     at Cn.handleAndLogRequestError (/app/node_modules/@prisma/client/runtime/library.js:123:6206)
documenso-documenso-1  |     at Cn.request (/app/node_modules/@prisma/client/runtime/library.js:123:5926)
documenso-documenso-1  |     at async l (/app/node_modules/@prisma/client/runtime/library.js:128:9968) {
documenso-documenso-1  |   name: 'LinkAccountError',
documenso-documenso-1  |   code: undefined
documenso-documenso-1  | }

if i also add not-before-policy to the scheme, i get an error that the character "-" ist not allowed in Field names.
The question is, why do you save unused variables in the databes? Just keep the vars that you need and the error is gone?

as a side note, here the oidc standard:
https://datatracker.ietf.org/doc/html/rfc6749#section-5.1

The client MUST ignore unrecognized value names in the response

@celevra commented on GitHub (Feb 5, 2025): ok i'm not a next.js or prisma expert, but i've change ext_expires_in to refresh_expires_in because to comment above was ``` // Stops next-auth from crashing when dealing with AzureAD ``` after the change it goes a step further but only until the next variable ``` documenso-documenso-1 | Invalid `prisma.account.create()` invocation: documenso-documenso-1 | documenso-documenso-1 | { documenso-documenso-1 | data: { documenso-documenso-1 | provider: "oidc", documenso-documenso-1 | type: "oauth", documenso-documenso-1 | providerAccountId: "ce2f22a9-3651-4041-90c7-2c2c9bf43758", documenso-documenso-1 | access_token: "xxx", documenso-documenso-1 | expires_at: 1738782434, documenso-documenso-1 | refresh_expires_in: 1800, documenso-documenso-1 | refresh_token: "xxx", documenso-documenso-1 | token_type: "Bearer", documenso-documenso-1 | id_token: "xxx", documenso-documenso-1 | not-before-policy: 0, documenso-documenso-1 | ~~~~~~~~~~~~~~~~~ documenso-documenso-1 | session_state: "d4518b2a-c36a-40b1-9a1b-bd3c0ebd9775", documenso-documenso-1 | scope: "openid profile email", documenso-documenso-1 | userId: 3, documenso-documenso-1 | ? id?: String, documenso-documenso-1 | ? created_at?: Int | Null, documenso-documenso-1 | ? user?: UserCreateNestedOneWithoutAccountsInput documenso-documenso-1 | } documenso-documenso-1 | } documenso-documenso-1 | documenso-documenso-1 | Unknown argument `not-before-policy`. Available options are marked with ?. documenso-documenso-1 | at En (/app/node_modules/@prisma/client/runtime/library.js:116:5888) documenso-documenso-1 | at Cn.handleRequestError (/app/node_modules/@prisma/client/runtime/library.js:123:6516) documenso-documenso-1 | at Cn.handleAndLogRequestError (/app/node_modules/@prisma/client/runtime/library.js:123:6206) documenso-documenso-1 | at Cn.request (/app/node_modules/@prisma/client/runtime/library.js:123:5926) documenso-documenso-1 | at async l (/app/node_modules/@prisma/client/runtime/library.js:128:9968) { documenso-documenso-1 | name: 'LinkAccountError', documenso-documenso-1 | code: undefined documenso-documenso-1 | } ``` if i also add not-before-policy to the scheme, i get an error that the character "-" ist not allowed in Field names. The question is, why do you save unused variables in the databes? Just keep the vars that you need and the error is gone? as a side note, here the oidc standard: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1 ``` The client MUST ignore unrecognized value names in the response ```

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@wafelmolt commented on GitHub (Feb 9, 2025):

+1. Same issue on my side. However, I guess the first assumption seems quite false to me. It has nothing to do with the value but with prisma validation.

@wafelmolt commented on GitHub (Feb 9, 2025): +1. Same issue on my side. However, I guess the first assumption seems quite false to me. It has nothing to do with the value but with prisma validation.

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@celevra commented on GitHub (Feb 9, 2025):

If i switch from docker to directly git compile like in the selfhosting documentation the error is gone and oidc works flawless
Could be because of this:
https://github.com/documenso/documenso/issues/1632

@celevra commented on GitHub (Feb 9, 2025): If i switch from docker to directly git compile like in the selfhosting documentation the error is gone and oidc works flawless Could be because of this: https://github.com/documenso/documenso/issues/1632

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@brotkastn commented on GitHub (Feb 26, 2025):

If i switch from docker to directly git compile like in the selfhosting documentation the error is gone and oidc works flawless Could be because of this: #1632

I still use docker, however i changed the compose.yml to refer to the 1.9.0 build (which is sadly not tagged):

documenso: image: documenso/documenso:b9ae27704161908cd409179a73d5f82bf0ad6432 depends_on:

After that change, i can login via keycloak oidc :)

@brotkastn commented on GitHub (Feb 26, 2025): > If i switch from docker to directly git compile like in the selfhosting documentation the error is gone and oidc works flawless Could be because of this: [#1632](https://github.com/documenso/documenso/issues/1632) I still use docker, however i changed the compose.yml to refer to the 1.9.0 build (which is sadly not tagged): ` documenso: image: documenso/documenso:b9ae27704161908cd409179a73d5f82bf0ad6432 depends_on: ` After that change, i can login via keycloak oidc :)

kerem commented

2026-02-26 18:46:46 +03:00

Author

Owner

@ephraimduncan commented on GitHub (Aug 23, 2025):

The codebase has migrated from NextAuth to a custom auth implementation using the Arctic OAuth library, which inherently fixes the original problem.

@ephraimduncan commented on GitHub (Aug 23, 2025): The codebase has migrated from NextAuth to a custom auth implementation using the Arctic OAuth library, which inherently fixes the original problem.

kerem referenced this issue

2026-02-26 19:31:03 +03:00

[PR #376] [CLOSED] feat: add-playwright #922

Rows
Columns

[GH-ISSUE #1342] oidc login error if refresh expires is 0 #376

Issue Description

Steps to Reproduce

Expected Behavior

Current Behavior

Screenshots (optional)

Operating System [e.g., Windows 10]

Browser [e.g., Chrome, Firefox]

Version [e.g., 2.0.1]

Please check the boxes that apply to this issue report.

🚨 Documenso Police 🚨