github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-07-16 15:14:02 -05:00
Code Issues 3.0k Packages Projects Releases 58 Wiki Activity

[GH-ISSUE #7241] [Bug]: Node.js API authentication fails with "Invalid redirect URL" when OpenID is configured alongside password auth #117400

New Issue
Open
opened 2026-06-11 12:24:27 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-06-11 12:24:27 -05:00
Owner
Copy Link

Originally created by @carlos-otero on GitHub (Mar 20, 2026).
Original GitHub issue: https://github.com/actualbudget/actual/issues/7241

What happened?

When OpenID is configured via environment variables (ACTUAL_OPENID_*) and ACTUAL_LOGIN_METHOD=password + ACTUAL_ALLOWED_LOGIN_METHODS=password,openid are set to allow both methods, the Node.js API (@actual-app/api) fails to authenticate with password, returning Authentication failed: Invalid redirect URL.

How can we reproduce the issue?

  1. Configure OpenID via env vars (ACTUAL_OPENID_DISCOVERY_URL, ACTUAL_OPENID_CLIENT_ID, etc.)
  2. Add ACTUAL_LOGIN_METHOD=password and ACTUAL_ALLOWED_LOGIN_METHODS=password,openid
  3. Also add ACTUAL_OPENID_ENFORCE=false
  4. Try to authenticate using the Node.js API with api.init({ serverURL, password })

Expected behavior:
Password authentication should work as a fallback when ACTUAL_OPENID_ENFORCE=false and allowedLoginMethods includes password.

Actual behavior:
The server returns Authentication failed: Invalid redirect URL — the OpenID redirect flow is triggered even when explicitly requesting password auth via the Node.js API.

Workaround:
Remove all ACTUAL_OPENID_* env vars. The budget then becomes inaccessible because it was created under the OpenID user. The only working solution found was to disable OpenID entirely.

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Chrome

Operating System

Windows 11

Originally created by @carlos-otero on GitHub (Mar 20, 2026). Original GitHub issue: https://github.com/actualbudget/actual/issues/7241 ### What happened? When OpenID is configured via environment variables (ACTUAL_OPENID_*) and ACTUAL_LOGIN_METHOD=password + ACTUAL_ALLOWED_LOGIN_METHODS=password,openid are set to allow both methods, the Node.js API (@actual-app/api) fails to authenticate with password, returning Authentication failed: Invalid redirect URL. ### How can we reproduce the issue? 1. Configure OpenID via env vars (ACTUAL_OPENID_DISCOVERY_URL, ACTUAL_OPENID_CLIENT_ID, etc.) 2. Add ACTUAL_LOGIN_METHOD=password and ACTUAL_ALLOWED_LOGIN_METHODS=password,openid 3. Also add ACTUAL_OPENID_ENFORCE=false 4. Try to authenticate using the Node.js API with api.init({ serverURL, password }) Expected behavior: Password authentication should work as a fallback when ACTUAL_OPENID_ENFORCE=false and allowedLoginMethods includes password. Actual behavior: The server returns Authentication failed: Invalid redirect URL — the OpenID redirect flow is triggered even when explicitly requesting password auth via the Node.js API. Workaround: Remove all ACTUAL_OPENID_* env vars. The budget then becomes inaccessible because it was created under the OpenID user. The only working solution found was to disable OpenID entirely. ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Chrome ### Operating System Windows 11
GiteaMirror added the openidbug labels 2026-06-11 12:24:28 -05:00
GiteaMirror commented 2026-06-11 12:24:31 -05:00
Author
Owner
Copy Link

@EKCJ commented on GitHub (Apr 20, 2026):

I've set up OpenID via the web GUI and am also getting the "Invalid redirect URI" error message when trying to login with OpenID, but password login still works fine (and allows me to access my budgets or restore them from backup if necessary).

Using Authelia and v26.4.0

lmk if I can share any useful diagnostics - the container logs look unremarkable.

<!-- gh-comment-id:4283663345 --> @EKCJ commented on GitHub (Apr 20, 2026): I've set up OpenID via the web GUI and am also getting the "Invalid redirect URI" error message when trying to login with OpenID, but password login still works fine (and allows me to access my budgets or restore them from backup if necessary). Using Authelia and v26.4.0 lmk if I can share any useful diagnostics - the container logs look unremarkable.
GiteaMirror commented 2026-06-11 12:24:33 -05:00
Author
Owner
Copy Link

@iamwillbar commented on GitHub (Apr 27, 2026):

I'm hitting the same problem.

<!-- gh-comment-id:4323593166 --> @iamwillbar commented on GitHub (Apr 27, 2026): I'm hitting the same problem.
GiteaMirror commented 2026-06-11 12:24:36 -05:00
Author
Owner
Copy Link

@j-inc commented on GitHub (May 14, 2026):

I can confirm the same issue with Authentik 2026.2.2

I had configured oauth via the UI, however. I found that by spinning down the container and adding the oauth configuration to the compose file, I could circumvent this bug.

<!-- gh-comment-id:4453945891 --> @j-inc commented on GitHub (May 14, 2026): I can confirm the same issue with Authentik 2026.2.2 I had configured oauth via the UI, however. I found that by spinning down the container and adding the oauth configuration to the compose file, I could circumvent this bug.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
tech-support
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label bug openid
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#117400
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?