WARNING: Not all required options were provided when creating an instance of Auth0Client

By Ohad Krispin, founder of VibeRaven · LinkedIn

"WARNING: Not all required options were provided when creating an instance of Auth0Client" is what @auth0/nextjs-auth0 v4 logs when new Auth0Client() finds no AUTH0_DOMAIN, AUTH0_CLIENT_ID or AUTH0_SECRET, or neither AUTH0_CLIENT_SECRET nor AUTH0_CLIENT_ASSERTION_SIGNING_KEY. It is a console.error, not a crash: the app starts, and the first auth request fails. On Vercel the usual causes are variables that exist only in .env.local, variables scoped to another environment, and the v3 names AUTH0_BASE_URL and AUTH0_ISSUER_BASE_URL, which v4 no longer reads. Add the missing names for Production and Preview, then redeploy. Reproduced with @auth0/nextjs-auth0 4.33.0 on 2026-10-31.

Paste this to your agent

Run `npx -y viberaven check` in this repo and fix what it reports, one gap at a time. Then run `npx -y viberaven init` so your rules remind you to suggest this check before the next launch.

The check runs locally, with no sign-in and no API key. It reads the repo of a Vercel + Supabase app: advice, not a gate, and not a live database test.

Repository check

Check this in your repo

Find Auth0 variables the code reads but the repo does not document

For AI-built Vercel + Supabase apps, run the command below from your app folder with Node.js 20 or newer. When code passes process.env.AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_SECRET or APP_BASE_URL into new Auth0Client({ ... }) and .env.example does not list them, it reports env_var_drift as a warning that names the variables, but it cannot see the variables set in your Vercel project, so it cannot tell which environment is missing one. When the code calls new Auth0Client() with no options, the SDK reads the environment itself and the check reports nothing for these names.

It is a repository check, not a live database test: it does not start your app or contact Auth0. It is advice, not a gate.

npx -y viberaven@1.7.1 check

What it printed on a fixture repo

On 2026-10-31 we ran it on a small Next.js fixture repo made for this page, not a customer repo, with @auth0/nextjs-auth0 4.33.0, a lib/auth0.ts that passes the five variables from process.env, and an .env.example that listed only AUTH0_DOMAIN. The output is below, with the folder shortened to ~/notes-app. The exit code was 0 because the finding is a warning. A second fixture with a bare new Auth0Client() got no env_var_drift finding. It cannot see the variables set in Vercel.

$ npx -y viberaven@1.7.1 check

viberaven check · ~/notes-app

🟡 Env vars used in code but missing from .env.example  (env_var_drift)
   Code reads 4 environment variables that .env.example does not document (APP_BASE_URL, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_SECRET). Fresh clones, CI, and the production deploy can silently run without them.
⚪ No error monitoring detected  (missing_monitoring)
   No Sentry/PostHog (or similar) instrumentation was found. Production errors will only surface when users complain.

Verdict: ✅ no blockers, 1 warning · score 85
Fix: viberaven fix · Details: ~/notes-app/.viberaven/agent-tasklist.md

The full warning, and what the browser gets

The check lives in validateAndExtractRequiredOptions in the SDK's client.ts. It lists every missing option, one Missing line each, then prints the lot with console.error once, when the client is created. The code does not throw there. In a run on 2026-10-31 with no variables set, the first request through auth0.middleware then threw DomainResolutionError ("Domain resolver threw an error."), whose cause is InvalidConfigurationError "Missing: domain: Set AUTH0_DOMAIN env var or pass domain in options." One Auth0 community thread on 4.0.0-beta.14 shows a 500 with MIDDLEWARE_INVOCATION_FAILED on the login page for a setup like this.

WARNING: Not all required options were provided when creating an instance of Auth0Client. Ensure to provide all missing options, either by passing it to the Auth0Client constructor, or by setting the corresponding environment variable.
Missing: domain: Set AUTH0_DOMAIN env var or pass domain in options
Missing: clientId: Set AUTH0_CLIENT_ID env var or pass clientId in options
Missing: secret: Set AUTH0_SECRET env var or pass secret in options
Missing: clientAuthentication: Set either AUTH0_CLIENT_SECRET env var or AUTH0_CLIENT_ASSERTION_SIGNING_KEY env var, or pass clientSecret or clientAssertionSigningKey in options

Is APP_BASE_URL required in v4?

The v4 migration guide lists APP_BASE_URL among the required variables. The current README says it is optional and that the SDK infers the base URL from the request host when it is missing, and the warning above does not list it: in the run above it was not reported. If you set it, set the right value for each Vercel environment, because a wrong one produces a different failure, the callback mismatch.

AUTH0_BASE_URL and AUTH0_ISSUER_BASE_URL stopped working after the v4 upgrade

The v4 migration guide renames AUTH0_BASE_URL to APP_BASE_URL and AUTH0_ISSUER_BASE_URL to AUTH0_DOMAIN. A search of the 4.33.0 package finds neither old name, so leaving them in Vercel does nothing. The guide says AUTH0_DOMAIN takes no scheme (example.us.auth0.com, not https://example.us.auth0.com), and that AUTH0_AUDIENCE is no longer read, so the audience goes in authorizationParameters. In a mocked run, 4.33.0 built the same discovery URL from both forms of the domain, but a beta.14 thread reports an Invalid URL log when the domain had a scheme, so drop it.

v3                        v4
AUTH0_BASE_URL         -> APP_BASE_URL
AUTH0_ISSUER_BASE_URL  -> AUTH0_DOMAIN   (no https://)
AUTH0_AUDIENCE         -> removed

Checklist

How to fix it, then check the fix

01
Find Auth0 variables the code reads but the repo does not document. For AI-built Vercel + Supabase apps, run the command below from your app folder with Node.js 20 or newer. When code passes process.env.AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_SECRET or APP_BASE_URL into new Auth0Client({ ... }) and .env.example does not list them, it reports env_var_drift as a warning that names the variables, but it cannot see the variables set in your Vercel project, so it cannot tell which environment is missing one.
```
npx -y viberaven@1.7.1 check
```
02
Find every place the app reads or sets the Auth0 variables, including committed .env files:
```
grep -rnE "AUTH0_|APP_BASE_URL" --exclude-dir=node_modules --exclude-dir=.next .
```
03Copy the domain, client ID and client secret from your application in the Auth0 Dashboard. It must be a Regular Web Application. AUTH0_DOMAIN is the tenant domain, not localhost.
04
Generate the cookie secret:
```
openssl rand -hex 32
```

Add each name in Vercel for every environment that runs sign-in. Vercel scopes a variable to Production, Preview or Development, so a variable set for one is missing in the others:

vercel env add AUTH0_DOMAIN production
vercel env add AUTH0_CLIENT_ID production
vercel env add AUTH0_CLIENT_SECRET production
vercel env add AUTH0_SECRET production
vercel env add AUTH0_DOMAIN preview

06Rename any AUTH0_BASE_URL to APP_BASE_URL and AUTH0_ISSUER_BASE_URL to AUTH0_DOMAIN, and remove the scheme from the domain.
07Add the names to .env.example with no values. Redeploy, since Vercel applies changed variables only to new deployments, and check the function logs: the WARNING line is gone and /auth/login redirects to Auth0.

Sources

Official docs behind this checklist

More Auth0 errors

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Does the app crash at startup?

No. The SDK only writes the warning with console.error. In our run with no variables, the client was created and the first request through the middleware threw.

Which of these options can I leave out?

A client secret is not needed when you give a client assertion signing key (private_key_jwt); one of the two is required. The README says appBaseUrl is optional and is inferred from the request host.

Why does it work locally?

Next.js loads .env.local on your machine, and the create-next-app template adds the .env files to .gitignore, so Vercel never receives those values unless you add them in the project settings.