[auth][error] UntrustedHost: Host must be trusted

By Ohad Krispin, founder of VibeRaven · LinkedIn

"[auth][error] UntrustedHost: Host must be trusted" means Auth.js v5 (next-auth 5 and @auth/core) received a request in production while its trustHost option was off, so the auth routes answer HTTP 500. next-auth turns trustHost on for you when AUTH_URL, AUTH_TRUST_HOST, VERCEL or CF_PAGES is set, or when NODE_ENV is not production. On Vercel, VERCEL=1 is a system environment variable, so the error there means the project has "Enable access to System Environment Variables" turned off, AUTH_URL or AUTH_TRUST_HOST is set to an empty value, or the config says trustHost: false. Turn the setting back on, delete the empty variable or the false option, and redeploy. On Docker, Railway or next start behind a proxy, set AUTH_TRUST_HOST=true or trustHost: true. Reproduced with @auth/core 0.41.3 on 2026-10-30.

The full message, and what the browser gets

Auth.js checks the host before anything else in each request, then the secret (core/src/lib/utils/assert.ts), and its logger prints the error type, the message and a link to errors.authjs.dev. The browser gets HTTP 500 with a message that only points at the server logs. Once the host is trusted, a missing secret is the next check, so the following error can be MissingSecret.

[auth][error] UntrustedHost: Host must be trusted. URL was: https://my-app.example.com/api/auth/session. Read more at https://errors.authjs.dev#untrustedhost

HTTP 500
{"message":"There was a problem with the server configuration. Check the server logs for more information."}

Why it can still happen on Vercel

In @auth/core (core/src/lib/utils/env.ts), trustHost defaults to AUTH_URL ?? AUTH_TRUST_HOST ?? VERCEL ?? CF_PAGES ?? (NODE_ENV !== "production"), turned into a boolean. Vercel sets VERCEL=1 at build and at runtime when access to system environment variables is enabled for the project. Because the code uses ??, a variable that is set but empty wins over VERCEL: in a run on 2026-10-30, AUTH_URL="" with VERCEL=1 left trustHost false. Any other value counts as set, so AUTH_TRUST_HOST=false still trusts the host.

NODE_ENV=production                       trustHost false
NODE_ENV=production VERCEL=1              trustHost true
NODE_ENV=production VERCEL=1 AUTH_URL=    trustHost false
NODE_ENV=production AUTH_TRUST_HOST=false trustHost true

Self-hosted: Docker, Railway, next start

Off Vercel and Cloudflare Pages nothing sets the variable for you. The Auth.js deployment docs say to set AUTH_TRUST_HOST=true behind a reverse proxy, which tells Auth.js to trust the X-Forwarded-Host header, and to set either trustHost: true or AUTH_TRUST_HOST=true in Docker. The core reference adds the condition: your deployment platform has to set the host header safely.

Checklist

How to fix it, then check the fix

Find every place the app sets trustHost or the variables it reads, including committed .env files:

grep -rnE "trustHost|AUTH_TRUST_HOST|AUTH_URL|NEXTAUTH_URL" --exclude-dir=node_modules --exclude-dir=.next .

02On Vercel, open the project's Environment Variables settings and check that "Enable access to System Environment Variables" is selected.
03Delete AUTH_URL or AUTH_TRUST_HOST wherever it is set with no value, in Vercel or in a committed .env file, and remove trustHost: false from the NextAuth config.
04Off Vercel, set AUTH_TRUST_HOST=true (or trustHost: true) only where a proxy or platform you control sets the Host and X-Forwarded-Host headers.
05Redeploy: Vercel applies changed variables only to new deployments. Then open /api/auth/session: it answers 200 with null when signed out, not a 500.

Sources

Official docs behind this checklist

More Auth.js errors

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Why does it work with next dev?

trustHost falls back to true whenever NODE_ENV is not production, and next dev runs in development. next build, next start and Vercel run with NODE_ENV=production.

Is setting AUTH_TRUST_HOST=true safe?

Auth.js relies on the host header of the incoming request, so it is safe where the platform or your own proxy sets that header. The Auth.js reference says to make sure your deployment platform sets the host header safely before you turn trustHost on.

Do I need AUTH_URL on Vercel?

Usually not. The Auth.js docs call it mostly unnecessary in v5, because the host comes from the request headers; set it only for a different base path. If you set it, give it a value: an empty AUTH_URL turns trustHost off.