How to redirect to a HTTPS callback URL?

[vedantroy]

I'm getting the error Error 400: redirect_uri_mismatch because my AuthJS application is redirecting to an HTTP callback URL instead of an HTTPS URL. I'm guessing this is happening because I'm using nginx, which terminates HTTPS. How can I tell AuthJS to pass a HTTPS redirect URL?

Request details: redirect_uri=http://<my_domain_name>/api/auth/callback/google flowName=GeneralOAuthFlow

[AndryRoby]

This is almost always a dropped X-Forwarded-Proto header between nginx and your app, not an Auth.js setting. When nginx terminates TLS and proxies to your app over plain HTTP without forwarding that header, the Google callback ends up built as http:// because that's genuinely what the request looked like by the time it reached your app.

Two things worth checking: (1) confirm proxy_set_header X-Forwarded-Proto https; (or $scheme if nginx is the one terminating TLS) is actually present in the specific location block handling this route. A nested location / proxy_pass with its own proxy_set_header directives silently drops headers set at the server level, so curl your own app directly and check what headers actually arrive. (2) Make sure NEXTAUTH_URL itself is the https:// version of your domain.

Once it's forcing https, I built a free tool that diffs your callback URL byte for byte against what's registered in Google Cloud Console, handy for catching the next one of these fast: https://arling.sk/google-oauth-redirect-doctor/