From 04e98115727769dca185f330461f50d0f8ff56c6 Mon Sep 17 00:00:00 2001
From: Randall Stillwell <me@randallstillwell.com>
Date: Wed, 15 Apr 2026 01:50:44 -0500
Subject: [PATCH] Fix Auth.js server error behind reverse proxy

Add trustHost: true to NextAuth config so Auth.js accepts requests
when running behind Traefik/reverse proxy. Without this, Auth.js
rejects the credential callback because the forwarded host doesn't
match its expectations.

Made-with: Cursor
---
 .env.example | 2 ++
 src/auth.ts  | 1 +
 2 files changed, 3 insertions(+)

diff --git a/.env.example b/.env.example
index 6ce7b3d..b3cc8fb 100644
--- a/.env.example
+++ b/.env.example
@@ -19,6 +19,8 @@ WATCH_DIR=""
 
 # Auth.js (required — generate with: npx auth secret)
 AUTH_SECRET=""
+# Set AUTH_URL to your external URL when behind a reverse proxy
+AUTH_URL="https://staging.echoocr.stillwell.cloud"
 
 # Authentik OIDC SSO (optional — enables "Sign in with SSO" button)
 # Create an OAuth2/OIDC provider in Authentik and set these values.
diff --git a/src/auth.ts b/src/auth.ts
index 17d462d..33b162c 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -7,6 +7,7 @@ import { prisma } from "@/lib/db";
 export const { handlers, auth, signIn, signOut } = NextAuth({
   adapter: PrismaAdapter(prisma),
   session: { strategy: "jwt" },
+  trustHost: true,
   pages: {
     signIn: "/login",
   },