[GH-ISSUE #844] Unable to configure OIDC authentication support with Authelia

kerem commented

2026-03-02 11:50:47 +03:00

Owner

Originally created by @jrhbcn on GitHub (Jan 6, 2025).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/844

Describe the Bug

I am unable to configure OIDC authentication support using authelia. My setup works for other similar selfhosted applications. However, with hoarder I get this error in the logs:

[next-auth][error][CLIENT_FETCH_ERROR]
https://next-auth.js.org/errors#client_fetch_error Unexpected token '<', "<!DOCTYPE "... is not valid JSON {
  error: {
    message: `Unexpected token '<', "<!DOCTYPE "... is not valid JSON`,
    stack: `SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON\n` +
      '    at JSON.parse (<anonymous>)\n' +
      '    at parseJSONFromBytes (node:internal/deps/undici/undici:5731:19)\n' +
      '    at successSteps (node:internal/deps/undici/undici:5712:27)\n' +
      '    at fullyReadBody (node:internal/deps/undici/undici:4609:9)\n' +
      '    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n' +
      '    at async consumeBody (node:internal/deps/undici/undici:5721:7)',
    name: 'SyntaxError'
  },
  url: 'https://hoarder.mydomain.com/api/auth/providers',
  message: `Unexpected token '<', "<!DOCTYPE "... is not valid JSON`
}

Steps to Reproduce

I have configured hoarder with the default docker compose adding the following variables:

OAUTH_WELLKNOWN_URL: https://auth.mydomain.com/.well-known/openid-configuration
OAUTH_CLIENT_SECRET: my_secret
OAUTH_CLIENT_ID: hoarder

I have nginx setup to proxy hoarder in "https://hoarder.mydomain.com" and I have configured Authelia as:

      - client_id: hoarder
        client_name: hoarder
        client_secret: my_secret
        public: false
        authorization_policy: one_factor
        redirect_uris:
          - https://hoarder.mydomain.com/api/auth/callback/custom
        scopes:
          - openid
          - email
          - profile
        grant_types:
          - authorization_code

Expected Behaviour

There is nothing on hoarder to login with Authelia OIDC.

Screenshots or Additional Context

No response

Device Details

No response

Exact Hoarder Version

0.21.0

Have you checked the troubleshooting guide?

I have checked the troubleshooting guide and I haven't found a solution to my problem

Originally created by @jrhbcn on GitHub (Jan 6, 2025). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/844 ### Describe the Bug I am unable to configure OIDC authentication support using authelia. My setup works for other similar selfhosted applications. However, with hoarder I get this error in the logs: ``` [next-auth][error][CLIENT_FETCH_ERROR] https://next-auth.js.org/errors#client_fetch_error Unexpected token '<', "<!DOCTYPE "... is not valid JSON { error: { message: `Unexpected token '<', "<!DOCTYPE "... is not valid JSON`, stack: `SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON\n` + ' at JSON.parse (<anonymous>)\n' + ' at parseJSONFromBytes (node:internal/deps/undici/undici:5731:19)\n' + ' at successSteps (node:internal/deps/undici/undici:5712:27)\n' + ' at fullyReadBody (node:internal/deps/undici/undici:4609:9)\n' + ' at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n' + ' at async consumeBody (node:internal/deps/undici/undici:5721:7)', name: 'SyntaxError' }, url: 'https://hoarder.mydomain.com/api/auth/providers', message: `Unexpected token '<', "<!DOCTYPE "... is not valid JSON` } ``` ### Steps to Reproduce I have configured hoarder with the default docker compose adding the following variables: ``` OAUTH_WELLKNOWN_URL: https://auth.mydomain.com/.well-known/openid-configuration OAUTH_CLIENT_SECRET: my_secret OAUTH_CLIENT_ID: hoarder ``` I have nginx setup to proxy hoarder in "https://hoarder.mydomain.com" and I have configured Authelia as: ``` - client_id: hoarder client_name: hoarder client_secret: my_secret public: false authorization_policy: one_factor redirect_uris: - https://hoarder.mydomain.com/api/auth/callback/custom scopes: - openid - email - profile grant_types: - authorization_code ``` ### Expected Behaviour There is nothing on hoarder to login with Authelia OIDC. ### Screenshots or Additional Context _No response_ ### Device Details _No response_ ### Exact Hoarder Version 0.21.0 ### Have you checked the troubleshooting guide? - [X] I have checked the troubleshooting guide and I haven't found a solution to my problem

kerem

2026-03-02 11:50:47 +03:00

closed this issue
added the
question
label

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@FrenchGap commented on GitHub (Jan 7, 2025):

I have the exact same issue with authentik. Set up all the env variables as you did. No button is present on Hoarder interface to sign up with my OAUTH_PROVIDER_NAME.

@FrenchGap commented on GitHub (Jan 7, 2025): I have the exact same issue with authentik. Set up all the env variables as you did. No button is present on Hoarder interface to sign up with my OAUTH_PROVIDER_NAME.

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@kamtschatka commented on GitHub (Jan 7, 2025):

https://next-auth.js.org/errors#client_fetch_error Unexpected token '<', "<!DOCTYPE "... is not valid JSON {
means that you are not hitting a proper endpoint (you are hitting some kind of webpage), so either your URL is wrong, or there is something in between hoarder and authelia, which returns a normal webpage with HTML inside.

@kamtschatka commented on GitHub (Jan 7, 2025): `https://next-auth.js.org/errors#client_fetch_error Unexpected token '<', "<!DOCTYPE "... is not valid JSON {` means that you are not hitting a proper endpoint (you are hitting some kind of webpage), so either your URL is wrong, or there is something in between hoarder and authelia, which returns a normal webpage with HTML inside.

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Jan 7, 2025):

Can you try adding this to your env file?

NEXTAUTH_URL_INTERNAL=http://localhost:3000

and check it it helps? I've seen those issues before, and we have a PR to bake this env variable in the dockerfile

@MohamedBassem commented on GitHub (Jan 7, 2025): Can you try adding this to your env file? NEXTAUTH_URL_INTERNAL=http://localhost:3000 and check it it helps? I've seen those issues before, and we have a PR to bake this env variable in the dockerfile

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@FrenchGap commented on GitHub (Jan 7, 2025):

Can you try adding this to your env file?

NEXTAUTH_URL_INTERNAL=http://localhost:3000

and check it it helps? I've seen those issues before, and we have a PR to bake this env variable in the dockerfile

Added to the env file and now the button appeared.
However, when clicking on it, it immediately throws an error "OAuth login failed: OAuthSignin"

The log gives this trace

[next-auth][error][SIGNIN_OAUTH_ERROR] 

https://next-auth.js.org/errors#signin_oauth_error expected 200 OK, got: 404 Not Found {

  error: {

    message: 'expected 200 OK, got: 404 Not Found',

    stack: 'n: expected 200 OK, got: 404 Not Found\n' +

      '    at e.exports (/app/apps/web/.next/server/chunks/8195.js:36:35487)\n' +

      '    at m.discover (/app/apps/web/.next/server/chunks/8195.js:36:42113)\n' +

      '    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n' +

      '    at async n (/app/apps/web/.next/server/chunks/8195.js:3:38671)\n' +

      '    at async a (/app/apps/web/.next/server/chunks/8195.js:3:31016)\n' +

      '    at async Object.a (/app/apps/web/.next/server/chunks/8195.js:27:8629)\n' +

      '    at async m (/app/apps/web/.next/server/chunks/8195.js:3:16370)\n' +

      '    at async o (/app/apps/web/.next/server/chunks/8195.js:27:19587)\n' +

      '    at async e.length.t (/app/apps/web/.next/server/chunks/8195.js:27:20997)\n' +

      '    at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:38411',

    name: 'n'

  },

  providerId: 'custom',

  message: 'expected 200 OK, got: 404 Not Found'

}

My env file looks like this

HOARDER_VERSION=release
NEXTAUTH_SECRET=ADTFP6IrykScXpotSBIG5ollmkdAw9sXfs4/xbsKvaTEC13N
MEILI_MASTER_KEY=bxzMh92T44ens4iJqnguW3lMrVc6VifaOix1ePr/JcgU96Ez
NEXTAUTH_URL=https://hoarder.mydomain.com
NEXTAUTH_URL_INTERNAL=http://localhost:3000
OLLAMA_BASE_URL=http://10.0.17.200:11434
INFERENCE_TEXT_MODEL=llama3.2
INFERENCE_IMAGE_MODEL=llama3.2
INFERENCE_CONTEXT_LENGTH=2048

DISABLE_SIGNUPS=true
DISABLE_PASSWORD_AUTH=true

OAUTH_PROVIDER_NAME=Authentik
OAUTH_WELLKNOWN_URL=https://authentik.mydomain.com/application/o/hoarder/jwks/
OAUTH_CLIENT_ID=authentik_client_id_redacted
OAUTH_CLIENT_SECRET=authentik_client_secret_redacted
OAUTH_SCOPE=openid email profile

@FrenchGap commented on GitHub (Jan 7, 2025): > Can you try adding this to your env file? > > NEXTAUTH_URL_INTERNAL=http://localhost:3000 > > and check it it helps? I've seen those issues before, and we have a PR to bake this env variable in the dockerfile Added to the env file and now the button appeared. However, when clicking on it, it immediately throws an error "OAuth login failed: OAuthSignin" The log gives this trace ``` [next-auth][error][SIGNIN_OAUTH_ERROR] https://next-auth.js.org/errors#signin_oauth_error expected 200 OK, got: 404 Not Found { error: { message: 'expected 200 OK, got: 404 Not Found', stack: 'n: expected 200 OK, got: 404 Not Found\n' + ' at e.exports (/app/apps/web/.next/server/chunks/8195.js:36:35487)\n' + ' at m.discover (/app/apps/web/.next/server/chunks/8195.js:36:42113)\n' + ' at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n' + ' at async n (/app/apps/web/.next/server/chunks/8195.js:3:38671)\n' + ' at async a (/app/apps/web/.next/server/chunks/8195.js:3:31016)\n' + ' at async Object.a (/app/apps/web/.next/server/chunks/8195.js:27:8629)\n' + ' at async m (/app/apps/web/.next/server/chunks/8195.js:3:16370)\n' + ' at async o (/app/apps/web/.next/server/chunks/8195.js:27:19587)\n' + ' at async e.length.t (/app/apps/web/.next/server/chunks/8195.js:27:20997)\n' + ' at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:38411', name: 'n' }, providerId: 'custom', message: 'expected 200 OK, got: 404 Not Found' } ``` My env file looks like this ``` HOARDER_VERSION=release NEXTAUTH_SECRET=ADTFP6IrykScXpotSBIG5ollmkdAw9sXfs4/xbsKvaTEC13N MEILI_MASTER_KEY=bxzMh92T44ens4iJqnguW3lMrVc6VifaOix1ePr/JcgU96Ez NEXTAUTH_URL=https://hoarder.mydomain.com NEXTAUTH_URL_INTERNAL=http://localhost:3000 OLLAMA_BASE_URL=http://10.0.17.200:11434 INFERENCE_TEXT_MODEL=llama3.2 INFERENCE_IMAGE_MODEL=llama3.2 INFERENCE_CONTEXT_LENGTH=2048 DISABLE_SIGNUPS=true DISABLE_PASSWORD_AUTH=true OAUTH_PROVIDER_NAME=Authentik OAUTH_WELLKNOWN_URL=https://authentik.mydomain.com/application/o/hoarder/jwks/ OAUTH_CLIENT_ID=authentik_client_id_redacted OAUTH_CLIENT_SECRET=authentik_client_secret_redacted OAUTH_SCOPE=openid email profile ```

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Jan 7, 2025):

@FrenchGap thanks for sharing your env variable. Your well known URL doesn't look right. If you check authentik's guide about hoarder: https://docs.goauthentik.io/integrations/services/hoarder/ you'll notice that it should look something like:

https://authentik.company/application/o/hoarder/.well-known/openid-configuration

@MohamedBassem commented on GitHub (Jan 7, 2025): @FrenchGap thanks for sharing your env variable. Your well known URL doesn't look right. If you check authentik's guide about hoarder: https://docs.goauthentik.io/integrations/services/hoarder/ you'll notice that it should look something like: ``` https://authentik.company/application/o/hoarder/.well-known/openid-configuration ```

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@FrenchGap commented on GitHub (Jan 7, 2025):

@MohamedBassem oops, well spotted haha. Fixed it and it definitely works now (if I manage to fix the OAuth login failed: OAuthAccountNotLinked error, which seems to be just a bit of config to amend I guess)

Thanks !

@FrenchGap commented on GitHub (Jan 7, 2025): @MohamedBassem oops, well spotted haha. Fixed it and it definitely works now (if I manage to fix the `OAuth login failed: OAuthAccountNotLinked` error, which seems to be just a bit of config to amend I guess) Thanks !

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Jan 7, 2025):

That should be fixed with 'OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true' which should be safe here because you own the oauth provider.

@MohamedBassem commented on GitHub (Jan 7, 2025): That should be fixed with 'OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true' which should be safe here because you own the oauth provider.

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@jrhbcn commented on GitHub (Jan 7, 2025):

Can you try adding this to your env file?

NEXTAUTH_URL_INTERNAL=http://localhost:3000

and check it it helps? I've seen those issues before, and we have a PR to bake this env variable in the dockerfile

Hi @MohamedBassem,

Thank you for the information. I have added the definition to my docker compose and it indeed works!! Just to let you know, I did modify the port in the docker compose (so the external port is different). So I defined with the internal docker name instead of localhost like:

NEXTAUTH_URL_INTERNAL=http://web:3000
And as I said, it works, connects to Authelia and I can login using auth users.

Many thanks again.

@jrhbcn commented on GitHub (Jan 7, 2025): > Can you try adding this to your env file? > > NEXTAUTH_URL_INTERNAL=http://localhost:3000 > > and check it it helps? I've seen those issues before, and we have a PR to bake this env variable in the dockerfile Hi @MohamedBassem, Thank you for the information. I have added the definition to my docker compose and it indeed works!! Just to let you know, I did modify the port in the docker compose (so the external port is different). So I defined with the internal docker name instead of localhost like: `NEXTAUTH_URL_INTERNAL=http://web:3000 ` And as I said, it works, connects to Authelia and I can login using auth users. Many thanks again.

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@roasted-watermelon commented on GitHub (Jan 21, 2025):

Just an additional note for the internal URL. Even if you have changed the external port on the compose file, the port on the internal url stays 3000.

compose.yaml

.env

@roasted-watermelon commented on GitHub (Jan 21, 2025): Just an additional note for the internal URL. Even if you have changed the external port on the compose file, the port on the internal url stays 3000. compose.yaml <img src=https://github.com/user-attachments/assets/82572e6e-2414-4f41-927b-205f260cf88b width=500/> .env <img src=https://github.com/user-attachments/assets/95cb0afd-3f71-429a-9099-c9969382be3f width=350/>

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@TheBig-O commented on GitHub (Feb 8, 2025):

I've read the tips above and I can get as far as the button to sign in with Authelia, but it immediately comes back with an error message on the web page saying "OAuth login failed: OAuthCallback".

The logs show:

[next-auth][error][OAUTH_CALLBACK_ERROR] 
https://next-auth.js.org/errors#oauth_callback_error invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).) {
  error: n: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
      at e.exports (/app/apps/web/.next/server/chunks/8195.js:36:35465)
      at Z.grant (/app/apps/web/.next/server/chunks/8195.js:36:15036)
      at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
      at async Z.callback (/app/apps/web/.next/server/chunks/8195.js:36:2813)
      at async c (/app/apps/web/.next/server/chunks/8195.js:3:33295)
      at async Object.l (/app/apps/web/.next/server/chunks/8195.js:27:783)
      at async m (/app/apps/web/.next/server/chunks/8195.js:3:15627)
      at async o (/app/apps/web/.next/server/chunks/8195.js:27:19587)
      at async e.length.t (/app/apps/web/.next/server/chunks/8195.js:27:20997)
      at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:38411 {
    name: 'OAuthCallbackError',
    code: undefined
  },
  providerId: 'custom',
  message: 'invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)'
}

My Authelia configuration looks like this:.

      - client_id: 'hoarder'
        client_name: 'hoarder'
        client_secret: 'SuperSecretHash'  
        public: false
        authorization_policy: one_factor
        redirect_uris:
          - https://hoarder.mydomain.com/api/auth/callback/custom
        scopes:
          - openid
          - email
          - profile
        grant_types:
          - authorization_code

My .env looks like:.

HOARDER_VERSION=release
NEXTAUTH_SECRET=Secret1
MEILI_MASTER_KEY=Secret2
NEXTAUTH_URL=https://hoarder.mydomain.com
NEXTAUTH_URL_INTERNAL=http://localhost:3000
NEXT_PUBLIC_SECRET=Secret3
SECRET=Secret4
OAUTH_PROVIDER_NAME="Authelia"
OAUTH_WELLKNOWN_URL=https://auth.mydomain.com/.well-known/openid-configuration
OAUTH_CLIENT_ID="hoarder"
OAUTH_CLIENT_SECRET="SuperSecretHash"
OAUTH_SCOPE="openid profile email"

About the only other thing in the chain is my NGINX Proxy Manager, but it shouldn't be getting in the way.
Any ideas what's going on?

@TheBig-O commented on GitHub (Feb 8, 2025): I've read the tips above and I can get as far as the button to sign in with Authelia, but it immediately comes back with an error message on the web page saying **"OAuth login failed: OAuthCallback"**. **The logs show:** ``` [next-auth][error][OAUTH_CALLBACK_ERROR] https://next-auth.js.org/errors#oauth_callback_error invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).) { error: n: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).) at e.exports (/app/apps/web/.next/server/chunks/8195.js:36:35465) at Z.grant (/app/apps/web/.next/server/chunks/8195.js:36:15036) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async Z.callback (/app/apps/web/.next/server/chunks/8195.js:36:2813) at async c (/app/apps/web/.next/server/chunks/8195.js:3:33295) at async Object.l (/app/apps/web/.next/server/chunks/8195.js:27:783) at async m (/app/apps/web/.next/server/chunks/8195.js:3:15627) at async o (/app/apps/web/.next/server/chunks/8195.js:27:19587) at async e.length.t (/app/apps/web/.next/server/chunks/8195.js:27:20997) at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:38411 { name: 'OAuthCallbackError', code: undefined }, providerId: 'custom', message: 'invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)' } ``` **My Authelia configuration looks like this:**. ``` - client_id: 'hoarder' client_name: 'hoarder' client_secret: 'SuperSecretHash' public: false authorization_policy: one_factor redirect_uris: - https://hoarder.mydomain.com/api/auth/callback/custom scopes: - openid - email - profile grant_types: - authorization_code ``` **My .env looks like:**. ``` HOARDER_VERSION=release NEXTAUTH_SECRET=Secret1 MEILI_MASTER_KEY=Secret2 NEXTAUTH_URL=https://hoarder.mydomain.com NEXTAUTH_URL_INTERNAL=http://localhost:3000 NEXT_PUBLIC_SECRET=Secret3 SECRET=Secret4 OAUTH_PROVIDER_NAME="Authelia" OAUTH_WELLKNOWN_URL=https://auth.mydomain.com/.well-known/openid-configuration OAUTH_CLIENT_ID="hoarder" OAUTH_CLIENT_SECRET="SuperSecretHash" OAUTH_SCOPE="openid profile email" ``` About the only other thing in the chain is my NGINX Proxy Manager, but it shouldn't be getting in the way. Any ideas what's going on?

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@kamtschatka commented on GitHub (Feb 8, 2025):

I bet it doesnt like the quotes

@kamtschatka commented on GitHub (Feb 8, 2025): I bet it doesnt like the quotes

kerem commented

2026-03-02 11:50:48 +03:00

Author

Owner

@TheBig-O commented on GitHub (Feb 8, 2025):

I tried it without the quotes. No luck. Still reverts back to the error "OAuth login failed: OAuthCallback".

@TheBig-O commented on GitHub (Feb 8, 2025): I tried it without the quotes. No luck. Still reverts back to the error "OAuth login failed: OAuthCallback".

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@petrm commented on GitHub (Feb 9, 2025):

You should get some useful information in the authelia logs. My config is very similar and it works just fine.
I would minimize the configuration in authelia config, you have some properties set that don't seem to be necessary (authorization_code etc).

@petrm commented on GitHub (Feb 9, 2025): You should get some useful information in the authelia logs. My config is very similar and it works just fine. I would minimize the configuration in authelia config, you have some properties set that don't seem to be necessary (authorization_code etc).

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@TheBig-O commented on GitHub (Feb 9, 2025):

I adjusted by my setup and still get an error.
I've tried adding, removing, etc. Each time I change something, I restart both containers, Authelia and Hoarder.
There's noting in the Authelia logs that seems helpful.
Any thoughts? The errors are still the same.

Authelia Log

{"level":"error",
"method":"POST",
"msg":"Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The provided client secret did not match the registered client secret.",
"path":"/api/oidc/token",
"remote_ip":"MY.IP.ADDRESS",
"time":"2025-02-09T13:07:04-05:00"}

Authelia Config

      - client_id: hoarder
        client_name: Hoarder OIDC
        client_secret: $pbkdf2-sha512
        public: false
        authorization_policy: one_factor
        redirect_uris:
          - https://hdrlinks.domain.com/api/auth/callback/custom
        scopes:
          - openid
          - email
          - profile

Hoarder .env variables

HOARDER_VERSION=release
NEXTAUTH_SECRET=secret
MEILI_MASTER_KEY=secret
NEXTAUTH_URL=https://hdrlinks.domain.com
NEXTAUTH_URL_INTERNAL=http://localhost:3000
NEXT_PUBLIC_SECRET=secret
SECRET=secret
OAUTH_PROVIDER_NAME=authelia
OAUTH_WELLKNOWN_URL=https://auth.domain.com/.well-known/openid-configuration
OAUTH_CLIENT_ID=hoarder
OAUTH_CLIENT_SECRET=$pbkdf2-sha512
OAUTH_SCOPE=openid profile email
#OAUTH_REDIRECT_URI=https://hdrlinks.domain.com/oauth/callback
OAUTH_PROVIDER_URL=https://auth.domain.com

Error

[next-auth][error][OAUTH_CALLBACK_ERROR] 
hoarder-web          | https://next-auth.js.org/errors#oauth_callback_error invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).) {
hoarder-web          |   error: n: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
hoarder-web          |       at e.exports (/app/apps/web/.next/server/chunks/8195.js:36:35465)
hoarder-web          |       at Z.grant (/app/apps/web/.next/server/chunks/8195.js:36:15036)
hoarder-web          |       at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
hoarder-web          |       at async Z.callback (/app/apps/web/.next/server/chunks/8195.js:36:2813)
hoarder-web          |       at async c (/app/apps/web/.next/server/chunks/8195.js:3:33295)
hoarder-web          |       at async Object.l (/app/apps/web/.next/server/chunks/8195.js:27:783)
hoarder-web          |       at async m (/app/apps/web/.next/server/chunks/8195.js:3:15627)
hoarder-web          |       at async o (/app/apps/web/.next/server/chunks/8195.js:27:19587)
hoarder-web          |       at async e.length.t (/app/apps/web/.next/server/chunks/8195.js:27:20997)
hoarder-web          |       at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:38411 {
hoarder-web          |     name: 'OAuthCallbackError',
hoarder-web          |     code: undefined
hoarder-web          |   },
hoarder-web          |   providerId: 'custom',
hoarder-web          |   message: 'invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)'
hoarder-web          | }

@TheBig-O commented on GitHub (Feb 9, 2025): I adjusted by my setup and still get an error. I've tried adding, removing, etc. Each time I change something, I restart both containers, Authelia and Hoarder. There's noting in the Authelia logs that seems helpful. Any thoughts? The errors are still the same. **Authelia Log** ``` {"level":"error", "method":"POST", "msg":"Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The provided client secret did not match the registered client secret.", "path":"/api/oidc/token", "remote_ip":"MY.IP.ADDRESS", "time":"2025-02-09T13:07:04-05:00"} ``` **Authelia Config** ``` - client_id: hoarder client_name: Hoarder OIDC client_secret: $pbkdf2-sha512 public: false authorization_policy: one_factor redirect_uris: - https://hdrlinks.domain.com/api/auth/callback/custom scopes: - openid - email - profile ``` **Hoarder .env variables** ``` HOARDER_VERSION=release NEXTAUTH_SECRET=secret MEILI_MASTER_KEY=secret NEXTAUTH_URL=https://hdrlinks.domain.com NEXTAUTH_URL_INTERNAL=http://localhost:3000 NEXT_PUBLIC_SECRET=secret SECRET=secret OAUTH_PROVIDER_NAME=authelia OAUTH_WELLKNOWN_URL=https://auth.domain.com/.well-known/openid-configuration OAUTH_CLIENT_ID=hoarder OAUTH_CLIENT_SECRET=$pbkdf2-sha512 OAUTH_SCOPE=openid profile email #OAUTH_REDIRECT_URI=https://hdrlinks.domain.com/oauth/callback OAUTH_PROVIDER_URL=https://auth.domain.com ``` **Error** ``` [next-auth][error][OAUTH_CALLBACK_ERROR] hoarder-web | https://next-auth.js.org/errors#oauth_callback_error invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).) { hoarder-web | error: n: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).) hoarder-web | at e.exports (/app/apps/web/.next/server/chunks/8195.js:36:35465) hoarder-web | at Z.grant (/app/apps/web/.next/server/chunks/8195.js:36:15036) hoarder-web | at process.processTicksAndRejections (node:internal/process/task_queues:105:5) hoarder-web | at async Z.callback (/app/apps/web/.next/server/chunks/8195.js:36:2813) hoarder-web | at async c (/app/apps/web/.next/server/chunks/8195.js:3:33295) hoarder-web | at async Object.l (/app/apps/web/.next/server/chunks/8195.js:27:783) hoarder-web | at async m (/app/apps/web/.next/server/chunks/8195.js:3:15627) hoarder-web | at async o (/app/apps/web/.next/server/chunks/8195.js:27:19587) hoarder-web | at async e.length.t (/app/apps/web/.next/server/chunks/8195.js:27:20997) hoarder-web | at async /app/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:6:38411 { hoarder-web | name: 'OAuthCallbackError', hoarder-web | code: undefined hoarder-web | }, hoarder-web | providerId: 'custom', hoarder-web | message: 'invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)' hoarder-web | } ```

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@ArturRuta commented on GitHub (Feb 15, 2025):

In case it helps someone running into similar problems....
I was integrating with authelia and authelia did prompted for the logon which proceed normally until de point of returning to hoarder after having validated the ID.
At that point it failed sayin that it could not link the users: oauth login failed oauthaccountnotlinked

Well, this was happening just because the user in question was already existing in hoader, it was manually registered before.

Setting OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true as described above took care of the issue.

For further security after validating that oauth integration was working I disabled password loing.

So far it's workin flawlessly. Thanks for a great piece of software.

@ArturRuta commented on GitHub (Feb 15, 2025): In case it helps someone running into similar problems.... I was integrating with authelia and authelia did prompted for the logon which proceed normally until de point of returning to hoarder after having validated the ID. At that point it failed sayin that it could not link the users: oauth login failed oauthaccountnotlinked Well, this was happening just because the user in question was already existing in hoader, it was manually registered before. Setting OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true as described above took care of the issue. For further security after validating that oauth integration was working I disabled password loing. So far it's workin flawlessly. Thanks for a great piece of software.

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@TheBig-O commented on GitHub (Feb 15, 2025):

@ArturRuta would you mind sharing the Hoarder piece from your Authelia configuration.yml and your .env?
I'm clearly doing something wrong, but I don't know what it is. I still cannot get past the "OAuth login failed: OAuthCallback" error.
Thanks!

@TheBig-O commented on GitHub (Feb 15, 2025): @ArturRuta would you mind sharing the Hoarder piece from your Authelia `configuration.yml` and your .env? I'm clearly doing something wrong, but I don't know what it is. I still cannot get past the "OAuth login failed: OAuthCallback" error. Thanks!

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@donjuanmon commented on GitHub (Apr 24, 2025):

@ArturRuta would you mind sharing the Hoarder piece from your Authelia configuration.yml and your .env? I'm clearly doing something wrong, but I don't know what it is. I still cannot get past the "OAuth login failed: OAuthCallback" error. Thanks!

Hey @TheBig-O, just ran into this myself. Fixed by using the hashed version in authelia config like you have: client_secret: $pbkdf2-sha512 Then use the plaintext version in the docker container. If you generated the client_secret per the docs here, it should give you a plaintext and hashed version. Hope this works for you!

@donjuanmon commented on GitHub (Apr 24, 2025): > [@ArturRuta](https://github.com/ArturRuta) would you mind sharing the Hoarder piece from your Authelia `configuration.yml` and your .env? I'm clearly doing something wrong, but I don't know what it is. I still cannot get past the "OAuth login failed: OAuthCallback" error. Thanks! Hey @TheBig-O, just ran into this myself. Fixed by using the hashed version in authelia config like you have: `client_secret: $pbkdf2-sha512` Then use the plaintext version in the docker container. If you generated the client_secret per the docs [here](https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#client-secret), it should give you a plaintext and hashed version. Hope this works for you!

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@TheBig-O commented on GitHub (Apr 24, 2025):

Thank you! I'll give this a try!

@TheBig-O commented on GitHub (Apr 24, 2025): Thank you! I'll give this a try!

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@meyca commented on GitHub (May 29, 2025):

I ran into the same error while using Authentik.

I had to choose a signing key in the OAuth-provider config for karakeep to get rid of the error message.

@meyca commented on GitHub (May 29, 2025): I ran into the same error while using Authentik. I had to choose a signing key in the OAuth-provider config for karakeep to get rid of the error message.

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@urbaman commented on GitHub (Jul 1, 2025):

Hi sorry, I am trying to set up Authentik and Karakeep, but keep getting

d [TRPCError]: User settings not found
    at /app/apps/web/.next/server/chunks/6815.js:1:41820
    at async X.h.middlewares (/app/apps/web/.next/server/chunks/269.js:4:46337)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async G (/app/apps/web/.next/server/chunks/269.js:4:45731)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async G (/app/apps/web/.next/server/chunks/269.js:4:46537)
    at async /app/apps/web/.next/server/chunks/269.js:7:5476
    at async Promise.all (index 1) {
  cause: undefined,
  code: 'NOT_FOUND',
  digest: '4237581454'
}

Are users to be already there in karakeep or what?

Thank you.

@urbaman commented on GitHub (Jul 1, 2025): Hi sorry, I am trying to set up Authentik and Karakeep, but keep getting ``` d [TRPCError]: User settings not found at /app/apps/web/.next/server/chunks/6815.js:1:41820 at async X.h.middlewares (/app/apps/web/.next/server/chunks/269.js:4:46337) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async G (/app/apps/web/.next/server/chunks/269.js:4:45731) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async G (/app/apps/web/.next/server/chunks/269.js:4:46537) at async /app/apps/web/.next/server/chunks/269.js:7:5476 at async Promise.all (index 1) { cause: undefined, code: 'NOT_FOUND', digest: '4237581454' } ``` Are users to be already there in karakeep or what? Thank you.

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Jul 1, 2025):

@urbaman this is a bug that has been fixed in the nightly build.

@MohamedBassem commented on GitHub (Jul 1, 2025): @urbaman this is a bug that has been fixed in the nightly build.

kerem commented

2026-03-02 11:50:49 +03:00

Author

Owner

@urbaman commented on GitHub (Jul 1, 2025):

Thank you very much, I'll wait for the release then!

@urbaman commented on GitHub (Jul 1, 2025): Thank you very much, I'll wait for the release then!

Rows
Columns

[GH-ISSUE #844] Unable to configure OIDC authentication support with Authelia #550

Describe the Bug

Steps to Reproduce

Expected Behaviour

Screenshots or Additional Context

Device Details

Exact Hoarder Version

Have you checked the troubleshooting guide?