OCID login doesn't work, always returning OAuthCallback errors

[hax4dazy]

Description

I'm trying to setup OCID login since I want to move away from putting homepage behind a VPN, however every time I attempt to setup OCID login it throws a "OAuthCallback" error.

Here is:

I've also included a screenshot of authentik so the redirect URL is visible there. Any ideas what is going on?

homepage version

Latest

Installation method

Docker

Configuration

services:
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage
    restart: unless-stopped
    volumes:
      - /srv/dev-disk-by-uuid-6f21d0e1-eec4-44f3-a95d-b36aa9e60448/Config/homepage:/app/config # Make sure your local config directory exists
      - /var/run/docker.sock:/var/run/docker.sock # (optional) For docker integrations
      - /srv/dev-disk-by-uuid-6f21d0e1-eec4-44f3-a95d-b36aa9e60448/Config/homepage/pictures:/app/public/images
      - /BlackHole/hax4dayz/emptyfolderpleasekeepmeimimportant:/emptyfolderimalsoimportant
      - /reallyimportantfolderthatshouldstayhereplease:/emptyfolderjustasimportantasthelastone
    environment:
      - PUID=1000
      - PGID=100
      - PORT=80
      - HOMEPAGE_EXTERNAL_URL=https://homepage
      - HOMEPAGE_ALLOWED_HOSTS=homepage
      - HOMEPAGE_AUTH_ENABLED=true
      - HOMEPAGE_AUTH_SECRET=fish2
      - HOMEPAGE_OIDC_ISSUER=https://authentik/application/o/homepaage/
      - HOMEPAGE_OIDC_CLIENT_ID=fish
      - HOMEPAGE_OIDC_CLIENT_SECRET=fish
      - HOMEPAGE_OIDC_NAME=authentik
      - LOG_LEVEL=debug
      - NODE_OPTIONS=--dns-result-order=ipv4first
    networks:
      MyMacVlan2:
        ipv4_address: 10.10.10.24


networks:
  MyMacVlan2:
    external: true

Container Logs

homepage | /app/config already owned by correct UID/GID, skipping chown
homepage | Fixing ownership of /app/.next
homepage | ▲ Next.js 16.3.0
homepage | - Local: http://[::1]:80
homepage | - Network: http://[::]:80
homepage | ✓ Ready in 0ms
homepage | ✓ Running next.config took 1.5ms
homepage | [2026-08-27T20:23:49.318Z] debug: CREATE_STATE
homepage | [2026-08-27T20:23:49.327Z] debug: CREATE_PKCECODEVERIFIER
homepage | [2026-08-27T20:23:49.329Z] debug: CREATE_NONCE
homepage | [2026-08-27T20:23:49.331Z] debug: GET_AUTHORIZATION_URL
homepage | [2026-08-27T20:23:52.470Z] error: OAUTH_CALLBACK_ERROR
homepage | [2026-08-27T20:37:38.161Z] debug: CREATE_STATE
homepage | [2026-08-27T20:37:38.163Z] debug: CREATE_PKCECODEVERIFIER
homepage | [2026-08-27T20:37:38.164Z] debug: CREATE_NONCE
homepage | [2026-08-27T20:37:38.166Z] debug: GET_AUTHORIZATION_URL
homepage | [2026-08-27T20:37:41.844Z] error: OAUTH_CALLBACK_ERROR

Browser Logs

Troubleshooting

Since i can't put it anywhere else, here's my Authentik config (Mainly to show that the redirect URL is correct)

[shamoon]

I dont use Authentik but many of our users do, so I asked Codex and heres the reply. Again Im not saying this is necessarily accurate but in case it helps (certainly the logs it mentions might be helpful):

Yes. The redirect URI appears correct, and Authentik successfully redirects back to Homepage with code and state. The failure occurs during Homepage’s callback processing—likely cookie validation, token exchange, DNS/TLS, or ID-token validation.

I’d suggest asking them to:

• Check Authentik server logs at 20:23:52 or 20:37:41, specifically whether /application/o/token/ was called and what status it returned.
• Verify that the Homepage container itself can resolve and trust Authentik’s certificate:

docker exec homepage node -e 'const i=process.env.HOMEPAGE_OIDC_ISSUER.replace(/\/+$/,""); fetch(i+"/.well-known/openid-configuration").then(r=>console.log(r.status,r.statusText)).catch(console.error)'

• Confirm that HOMEPAGE_EXTERNAL_URL exactly matches the URL used in the browser—same scheme, hostname, and port. A mismatch can cause the state/PKCE/nonce cookies to be absent on callback.
• Confirm the apparent homepaage spelling is intentional in both the issuer and Authentik provider slug. It is consistent in their screenshots, so it may just be their chosen spelling.
• Provide the exact Homepage version/image digest and Authentik callback/token logs.

[hax4dazy]

So I checked what you wrote and

1. Logs look fine, Authentik is signing me in correctly
2. docker exect command returns a 200 (so I guess that's also fine?)
3. External URL is also fine
4. yep homepaage is intentional since I wanted to re-create the thing in authentik
5. The exact version is "4db0d685162ee37a47f8f27ec9cab68417ee16e8248042e503e0e5d1d8076ba9"

[shamoon]

If you install the :dev docker image it might help us with more detailed logging, please post what you find

[hax4dazy]

Welp, this did the trick. I got the error "unexpected JWT alg received, expected RS256, got: HS256" which pointed me in the correct direction. To fix this, do the following:

1. Go to authentik
2. Under System, select Certificates
3. Generate a new certificate-key pair
4. Leave the Private key algorithm as RSA, the common name and validity days can be whatever you want.
5. Once generated, go to the homepage provider
6. Click edit to edit the provider, then scroll down
7. In the "signing key" options, select the certificate you just made
8. Save your changes

Could it maybe be documented anywhere that the dev tag has more verbose logging? Or that homepage expects a RSA256 key?

Also, can I now switch back to use latest instead of the dev tag? Are there any breaking changes that the dev tag makes to my setup?

[shamoon]

The change to increase logging will be in the next release, thats why I added it =)

[jmercz]

I also had issues with OIDC and authentik using a custom root-CA in my homelab and after a good hour of debugging, asking Copilot and almost eating my keyboard I found a solution that others might help.
The Homepage logs only gave me
error: <nextauth> SIGNIN_OAUTH_ERROR

The command docker exec homepage node -e 'const i=process.env.HOMEPAGE_OIDC_ISSUER.replace(/\/+$/,""); fetch(i+"/.well-known/openid-configuration").then(r=>console.log(r.status,r.statusText)).catch(console.error)' (thanks @shamoon) put me in the right direction and Copilot suggested that it is because Node.js happens to use its own TLS-stack, not the one from the container in /etc/ssl/certs/, which I did map into my container already.

TL;DR:
Copying the root-CA (e.g "rootCA.crt") into my container working directory and putting the following into my compose.yaml:

    volumes:
      [...]
      - ./rootCA.crt:/usr/local/share/ca-certificates/rootCA.crt:ro
    environment:
      [...]
      NODE_EXTRA_CA_CERTS: /usr/local/share/ca-certificates/rootCA.crt

resolves the issues.
I realised that mapping the trust store in /etc/ssl/certs/ into the container is not necessary, as it works without that bind mount too.

Hope this helps!

[hax4dazy]

You don't have the same issue as I do. The only error in my logs is "OAUTH_CALLBACK_ERROR". Also since the command returns a 200 for me it doesn't seem like TLS issue?

[github-actions[bot]]

This discussion has been automatically closed because it was marked as answered. See our contributing guidelines for more details.

[github-actions[bot]]

This discussion has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion for related concerns. See our contributing guidelines for more details.