Pixelflare

Appearance

Auth Troubleshooting ​

"Authentication not configured" Error ​

Cause: Missing AUTH_SECRET when using Auth.js mode.

Solution:

bash
openssl rand -base64 32
npx wrangler secret put AUTH_SECRET

"Invalid JWT signature" Error (Cloudflare Access) ​

Cause: Incorrect CF_ACCESS_CERTS_URL or CF_ACCESS_AUD.

Solution:

  1. Verify team name in certs URL: https://YOUR_TEAM.cloudflareaccess.com/cdn-cgi/access/certs
  2. Verify audience tag in Zero Trust Dashboard under application overview
  3. Check Workers logs for detailed JWT validation errors: npx wrangler tail

"MissingCSRF" Error (Auth.js) ​

Cause: CSRF token not properly fetched or expired.

Solution:

  • Ensure login page fetches /auth/csrf before form submission
  • Check browser console for CORS errors
  • Verify credentials: 'include' in fetch requests
  • Clear browser cookies and try again

Login Redirects to Homepage Instead of App ​

Cause: Redirect callback not configured in Auth.js.

Solution: Already fixed in code - redirects to /app after successful authentication.

API Key Returns 401 Unauthorized ​

Cause: Invalid API key, expired, or revoked.

Solution:

  1. Verify API key is correct (check for typos)
  2. Check expiration date in dashboard
  3. Verify key has required scopes for operation
  4. Check IP whitelist if configured
  5. Generate new API key if needed

"Not authenticated" on /_auth-check ​

Cause: Session cookie missing or invalid.

Solution:

  1. Check browser cookies for authjs.session-token or CF_Authorization
  2. Verify AUTH_MODE is set correctly
  3. For Cloudflare Access, ensure user passed Zero Trust authentication
  4. For Auth.js, ensure user logged in through /login
  5. Check Workers logs for detailed authentication errors

CORS Errors on Auth Requests ​

Cause: Frontend and API on different origins without proper CORS configuration.

Solution:

  • Development: Ensure VITE_API_URL=http://localhost:8787 in frontend .env
  • Production: Ensure API is served from /api path or APP_HOST is configured correctly
  • Check API CORS middleware allows frontend origin

Additional Resources ​