github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-05-06 20:15:33 -05:00
Code Issues 1.5k Packages Projects Releases 55 Wiki Activity

[GH-ISSUE #7241] [Bug]: Node.js API authentication fails with "Invalid redirect URL" when OpenID is configured alongside password auth #28811

New Issue
Open
opened 2026-04-18 05:33:39 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-18 05:33:39 -05:00
Owner
Copy Link

Originally created by @carlos-otero on GitHub (Mar 20, 2026).
Original GitHub issue: https://github.com/actualbudget/actual/issues/7241

What happened?

When OpenID is configured via environment variables (ACTUAL_OPENID_*) and ACTUAL_LOGIN_METHOD=password + ACTUAL_ALLOWED_LOGIN_METHODS=password,openid are set to allow both methods, the Node.js API (@actual-app/api) fails to authenticate with password, returning Authentication failed: Invalid redirect URL.

How can we reproduce the issue?

  1. Configure OpenID via env vars (ACTUAL_OPENID_DISCOVERY_URL, ACTUAL_OPENID_CLIENT_ID, etc.)
  2. Add ACTUAL_LOGIN_METHOD=password and ACTUAL_ALLOWED_LOGIN_METHODS=password,openid
  3. Also add ACTUAL_OPENID_ENFORCE=false
  4. Try to authenticate using the Node.js API with api.init({ serverURL, password })

Expected behavior:
Password authentication should work as a fallback when ACTUAL_OPENID_ENFORCE=false and allowedLoginMethods includes password.

Actual behavior:
The server returns Authentication failed: Invalid redirect URL — the OpenID redirect flow is triggered even when explicitly requesting password auth via the Node.js API.

Workaround:
Remove all ACTUAL_OPENID_* env vars. The budget then becomes inaccessible because it was created under the OpenID user. The only working solution found was to disable OpenID entirely.

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Chrome

Operating System

Windows 11

Originally created by @carlos-otero on GitHub (Mar 20, 2026). Original GitHub issue: https://github.com/actualbudget/actual/issues/7241 ### What happened? When OpenID is configured via environment variables (ACTUAL_OPENID_*) and ACTUAL_LOGIN_METHOD=password + ACTUAL_ALLOWED_LOGIN_METHODS=password,openid are set to allow both methods, the Node.js API (@actual-app/api) fails to authenticate with password, returning Authentication failed: Invalid redirect URL. ### How can we reproduce the issue? 1. Configure OpenID via env vars (ACTUAL_OPENID_DISCOVERY_URL, ACTUAL_OPENID_CLIENT_ID, etc.) 2. Add ACTUAL_LOGIN_METHOD=password and ACTUAL_ALLOWED_LOGIN_METHODS=password,openid 3. Also add ACTUAL_OPENID_ENFORCE=false 4. Try to authenticate using the Node.js API with api.init({ serverURL, password }) Expected behavior: Password authentication should work as a fallback when ACTUAL_OPENID_ENFORCE=false and allowedLoginMethods includes password. Actual behavior: The server returns Authentication failed: Invalid redirect URL — the OpenID redirect flow is triggered even when explicitly requesting password auth via the Node.js API. Workaround: Remove all ACTUAL_OPENID_* env vars. The budget then becomes inaccessible because it was created under the OpenID user. The only working solution found was to disable OpenID entirely. ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Chrome ### Operating System Windows 11
GiteaMirror added the openidbug labels 2026-04-18 05:33:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label bug openid
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#28811
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?