Can't login locally or in production using Github App

[tselmek]

Hi, I'm trying to deploy a fresh instance of Outstatic.

I've followed the steps in the Getting started guide here : https://outstatic.com/docs/using-outstatic-for-markdown-content
Using a Github App : https://outstatic.com/docs/github-apps-authentication

Information

• Locally using MacOS Sequoia 15.6
• Next 15.3.3 / React 19.1.0
• outstatic 2.0.9 (latest)

Issue description

When trying to login locally or on my Vercel deployment, I get the same 500 error as follows:

 GET /outstatic 200 in 3523ms
 ○ Compiling /api/outstatic/[[...ost]] ...
 ✓ Compiled /api/outstatic/[[...ost]] in 749ms (4650 modules)
 GET /api/outstatic/login 200 in 1330ms
Session validation failed: {
  hasSession: true,
  sessionType: 'object',
  hasUser: true,
  userName: 'string',
  userLogin: 'string',
  userEmail: 'object',
  userImage: 'string',
  accessToken: 'string',
  expiresValid: true,
  expiresValue: 2025-08-17T01:19:22.757Z
}
 ⨯ [Error: Invalid session data]
 ⨯ [Error: Invalid session data]
 GET /api/outstatic/callback?code=6ecc929084934eb22a14 500 in 832ms

I'm curious if any of you ran into this issue and managed to fix it.
I can't pinpoint whether it's a bug with outstatic or a mishaps in my configuration.
I'm happy to bring more detail to help solve this issue and would love your input on this. 🙏

My Github App is configured as follows:

[avitorio]

Can you help me debug this? The issue there is that userEmail should be a string and not an object.
Can you check your console.log in your local version to see if the session.user object has an email that is not a string?

You should also add your local callback url to your app settings if you haven't already.

[tselmek]

In my local browser console, session is null. Here's the full log:

[tselmek]

To give more detail if that helps, the error happens on the callback route even after the login route was successful.

I've tried logging each step of the /api/oustatic/[[...ost]]/route.ts as follows:

export const GET = async (req: Request, res: { params: GetParams }) => {
  console.log("GET request", req);
  const response = await OutstaticApi.GET(req, res)
  console.log("GET response", response);
  const data = await response.json()
  console.log("GET data", data);  
  return NextResponse.json(data)
}

And here is what I get (seems like the body in response is null):

GET request Request {
  method: 'GET',
  url: 'http://localhost:3001/api/outstatic/login',
  headers: Headers {
    host: 'localhost:3001',
    connection: 'keep-alive',
    'sec-ch-ua-platform': '"macOS"',
    'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36',
    'sec-ch-ua': '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"',
    'sec-ch-ua-mobile': '?0',
    accept: '*/*',
    'sec-fetch-site': 'same-origin',
    'sec-fetch-mode': 'cors',
    'sec-fetch-dest': 'empty',
    referer: 'http://localhost:3001/outstatic',
    'accept-encoding': 'gzip, deflate, br, zstd',
    'accept-language': 'fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,ko-KR;q=0.6,ko;q=0.5',
    'x-forwarded-host': 'localhost:3001',
    'x-forwarded-port': '3001',
    'x-forwarded-proto': 'http',
    'x-forwarded-for': '::1'
  },
  destination: '',
  referrer: 'about:client',
  referrerPolicy: '',
  mode: 'cors',
  credentials: 'same-origin',
  cache: 'default',
  redirect: 'follow',
  integrity: '',
  keepalive: false,
  isReloadNavigation: false,
  isHistoryNavigation: false,
  signal: AbortSignal { aborted: false }
}
GET response Response {
  status: 200,
  statusText: '',
  headers: Headers { 'content-type': 'application/json' },
  body: ReadableStream { locked: false, state: 'readable', supportsBYOB: true },
  bodyUsed: false,
  ok: true,
  redirected: false,
  type: 'default',
  url: ''
}
GET data {
  url: 'https://github.com/login/oauth/authorize?client_id=Iv23liontbRPmxWQJhbz&scope=read%3Auser%2Cuser%3Aemail%2Crepo&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3001%2Fapi%2Foutstatic%2Fcallback'
}
 GET /api/outstatic/login 200 in 16ms
(node:10131) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
GET request Request {
  method: 'GET',
  url: 'http://localhost:3001/api/outstatic/callback?code=6af149b46b5fccb37f5d',
  headers: Headers {
    host: 'localhost:3001',
    connection: 'keep-alive',
    'sec-ch-ua': '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"macOS"',
    'upgrade-insecure-requests': '1',
    'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36',
    accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'sec-fetch-site': 'cross-site',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-dest': 'document',
    'accept-encoding': 'gzip, deflate, br, zstd',
    'accept-language': 'fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,ko-KR;q=0.6,ko;q=0.5',
    'x-forwarded-host': 'localhost:3001',
    'x-forwarded-port': '3001',
    'x-forwarded-proto': 'http',
    'x-forwarded-for': '::1'
  },
  destination: '',
  referrer: 'about:client',
  referrerPolicy: '',
  mode: 'cors',
  credentials: 'same-origin',
  cache: 'default',
  redirect: 'follow',
  integrity: '',
  keepalive: false,
  isReloadNavigation: false,
  isHistoryNavigation: false,
  signal: AbortSignal { aborted: false }
}
(node:10140) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
GET response Response {
  status: 307,
  statusText: '',
  headers: Headers { Location: 'http://localhost:3001/outstatic' },
  body: null,
  bodyUsed: false,
  ok: false,
  redirected: false,
  type: 'default',
  url: ''
}
 ⨯ SyntaxError: Unexpected end of JSON input
    at JSON.parse (<anonymous>)
    at GET (src/app/api/outstatic/[[...ost]]/route.ts:11:30)
   9 |   console.log("GET response", response);
  10 |
> 11 |   const data = await response.json()
     |                              ^
  12 |
  13 |   console.log("GET data", data);  
  14 |
 ⨯ SyntaxError: Unexpected end of JSON input
    at JSON.parse (<anonymous>)
    at GET (src/app/api/outstatic/[[...ost]]/route.ts:11:30)
   9 |   console.log("GET response", response);
  10 |
> 11 |   const data = await response.json()
     |                              ^
  12 |
  13 |   console.log("GET data", data);  
  14 |
 GET /api/outstatic/callback?code=6af149b46b5fccb37f5d 500 in 929ms

[avitorio]

If you clear your cookies and try again, do you get to the github install app screen?

…

On Sun 17 Aug 2025 at 09:57, Antoine Jésus ***@***.***> wrote: To give more detail if that helps, the error happens on the callback route even after the login route was successful. I've tried logging each step of the /api/oustatic/[[...ost]]/route.ts as follows: export const GET = async (req: Request, res: { params: GetParams }) => { console.log("GET request", req); const response = await OutstaticApi.GET(req, res) console.log("GET response", response); const data = await response.json() console.log("GET data", data); return NextResponse.json(data)} And here is what I get (seems like the body in response is null): GET request Request { method: 'GET', url: 'http://localhost:3001/api/outstatic/login', headers: Headers { host: 'localhost:3001', connection: 'keep-alive', 'sec-ch-ua-platform': '"macOS"', 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36', 'sec-ch-ua': '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"', 'sec-ch-ua-mobile': '?0', accept: '*/*', 'sec-fetch-site': 'same-origin', 'sec-fetch-mode': 'cors', 'sec-fetch-dest': 'empty', referer: 'http://localhost:3001/outstatic', 'accept-encoding': 'gzip, deflate, br, zstd', 'accept-language': 'fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,ko-KR;q=0.6,ko;q=0.5', 'x-forwarded-host': 'localhost:3001', 'x-forwarded-port': '3001', 'x-forwarded-proto': 'http', 'x-forwarded-for': '::1' }, destination: '', referrer: 'about:client', referrerPolicy: '', mode: 'cors', credentials: 'same-origin', cache: 'default', redirect: 'follow', integrity: '', keepalive: false, isReloadNavigation: false, isHistoryNavigation: false, signal: AbortSignal { aborted: false } } GET response Response { status: 200, statusText: '', headers: Headers { 'content-type': 'application/json' }, body: ReadableStream { locked: false, state: 'readable', supportsBYOB: true }, bodyUsed: false, ok: true, redirected: false, type: 'default', url: '' } GET data { url: 'https://github.com/login/oauth/authorize?client_id=Iv23liontbRPmxWQJhbz&scope=read%3Auser%2Cuser%3Aemail%2Crepo&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3001%2Fapi%2Foutstatic%2Fcallback' } GET /api/outstatic/login 200 in 16ms (node:10131) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead. (Use `node --trace-deprecation ...` to show where the warning was created) GET request Request { method: 'GET', url: 'http://localhost:3001/api/outstatic/callback?code=6af149b46b5fccb37f5d', headers: Headers { host: 'localhost:3001', connection: 'keep-alive', 'sec-ch-ua': '"Not)A;Brand";v="8", "Chromium";v="138", "Google Chrome";v="138"', 'sec-ch-ua-mobile': '?0', 'sec-ch-ua-platform': '"macOS"', 'upgrade-insecure-requests': '1', 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7', 'sec-fetch-site': 'cross-site', 'sec-fetch-mode': 'navigate', 'sec-fetch-dest': 'document', 'accept-encoding': 'gzip, deflate, br, zstd', 'accept-language': 'fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,ko-KR;q=0.6,ko;q=0.5', 'x-forwarded-host': 'localhost:3001', 'x-forwarded-port': '3001', 'x-forwarded-proto': 'http', 'x-forwarded-for': '::1' }, destination: '', referrer: 'about:client', referrerPolicy: '', mode: 'cors', credentials: 'same-origin', cache: 'default', redirect: 'follow', integrity: '', keepalive: false, isReloadNavigation: false, isHistoryNavigation: false, signal: AbortSignal { aborted: false } } (node:10140) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead. (Use `node --trace-deprecation ...` to show where the warning was created) GET response Response { status: 307, statusText: '', headers: Headers { Location: 'http://localhost:3001/outstatic' }, body: null, bodyUsed: false, ok: false, redirected: false, type: 'default', url: '' } ⨯ SyntaxError: Unexpected end of JSON input at JSON.parse (<anonymous>) at GET (src/app/api/outstatic/[[...ost]]/route.ts:11:30) 9 | console.log("GET response", response); 10 |> 11 | const data = await response.json() | ^ 12 | 13 | console.log("GET data", data); 14 | ⨯ SyntaxError: Unexpected end of JSON input at JSON.parse (<anonymous>) at GET (src/app/api/outstatic/[[...ost]]/route.ts:11:30) 9 | console.log("GET response", response); 10 |> 11 | const data = await response.json() | ^ 12 | 13 | console.log("GET data", data); 14 | GET /api/outstatic/callback?code=6af149b46b5fccb37f5d 500 in 929ms — Reply to this email directly, view it on GitHub <#326 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKZ7FKN3PKUXTIYEHT3IF33OB32BAVCNFSM6AAAAACEBWQ322VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIMJTGE4DONA> . You are receiving this because you commented.Message ID: ***@***.***>

[tselmek]

The env used for this test:

NEXT_PUBLIC_APP_URL=http://localhost:3000

OST_GITHUB_ID=<REDACTED>
OST_GITHUB_SECRET=<REDACTED>
OST_REPO_SLUG=outstatic
OST_REPO_BRANCH=main
OST_CONTENT_PATH=outstatic/content
OST_MONOREPO_PATH=apps/dev

OST_GITHUB_CALLBACK_URL=http://localhost:3000/api/outstatic/callback

I've also tried with OST_REPO_SLUG=alise-content. (the name of my project)

Edit: I've confirmed no cookie is set.

[tselmek]

I've tried logging the access token and data fetched from Github as follows:

I do get an access token and a refresh token. I also get a user data object from github but in that object the attribute email is null.

[tselmek]

I might have pinpointed the issue, fetching the emails after first userData.email was null returns a 403 error as follows:

{
   message: 'Resource not accessible by integration',
   documentation_url: 'https://docs.github.com/rest/users/emails#list-email-addresses-for-the-authenticated-user',
   status: '403'
}

[tselmek]

Okay, giving the Github app Read-only access to Emails in the Account permissions of the app fixed the login problem after clearing all cookies and reinitializing accesses. 🎉

Thank you very much for your time on this issue. I think this deserves a mention in the docs on setting up the Github app.

I do have a follow-up question, does the repo need to be public for the content to be accessible by Outstatic?

[avitorio]

I'm glad you figured it out!

I'll add it to the docs, unless you want to fork the project, and then run pnpm dev:docs to update it yourself.
It would be cool to have you as a contributor of the project after this odyseey.

If not, let me know and I'll do it myself.

As for the follow up, nope, the repo doesn't have to be public, but the person logged in the dashboard needs to be either the owner or a collaborator of the project.

Cheers!

[tselmek]

Thank you for your nudges and very timely response. 🙏

I'm up for contributing to the docs. I hope to find the time in the next few days, but if you don't see my contribution popping up, feel free to go ahead.

[avitorio]

I did end up updating the docs.

Thank you for flagging the issues here, that’s super helpful.