Issue with Authentik Issuer/Authorization

[HarjivenDodd]

I've recently added Authentik to my Lobechat instance in order to allow for rmultiple users. But ever since adding Authentik I've had the error below repeatedly.

[auth][error] InvalidEndpoints: Provider "authentik" is missing both issuer and authorization endpoint config. At least one of them is required. Read more at https://errors.authjs.dev#invalidendpoints
at /app/.next/server/app/(backend)/trpc/edge/[trpc]/route.js:377:56306
at ap (/app/.next/server/app/(backend)/trpc/edge/[trpc]/route.js:377:58250)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)

I am running this in unraid, and here are my Environment Variables.

I seem to have provided my issuer, can anyone please help me figure out the issue here?

[lobehubbot]

👀 @HarjivenDodd

Thank you for raising an issue. We will investigate into the matter and get back to you as soon as possible.
Please make sure you have given us as much context as possible.
非常感谢您提交 issue。我们会尽快调查此事，并尽快回复您。 请确保您已经提供了尽可能多的背景信息。

[dosubot[bot]]

Hi @HarjivenDodd! I'm Dosu and I’m helping the lobe-chat team.

The error means Lobe Chat can't find the required Authentik endpoints because of a misconfiguration in your environment variables. Double-check that you are using the new variable names (not the old ones) and that all are set correctly:

• AUTH_AUTHENTIK_ID: your Authentik client ID
• AUTH_AUTHENTIK_SECRET: your Authentik client secret
• AUTH_AUTHENTIK_ISSUER: the full OpenID issuer URL from your Authentik app (should look like https://auth.example.com/application/o/your-app/)
• NEXT_AUTH_SSO_PROVIDERS: must include authentik
• NEXTAUTH_URL: your Lobe Chat URL with /api/auth at the end (e.g., https://yourdomain.com/api/auth)
• NEXT_AUTH_SECRET: a random string (e.g., from openssl rand -base64 32)

Legacy names like AUTHENTIK_CLIENT_ID, AUTHENTIK_CLIENT_SECRET, and AUTHENTIK_ISSUER are deprecated and may not work as expected—use the new names above instead. If you use the old names, Lobe Chat will log a warning and ignore them in future versions (source).

Make sure the issuer URL is accessible from inside your container (try curl https://your-issuer-url/.well-known/openid-configuration from within the container). If it doesn't return JSON, the URL or network is wrong (source).

If you still see the error, check your logs for warnings about deprecated or missing variables. If you want, you can share your (redacted) environment variable config for more help.

Full variable list and example:
Reference
Code details

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}