[BUG] Pocket ID won't work to log in - "OAuth provider did not return an email"

Describe the bug
Pocket ID log in doesn't work, not returning an email.

I am using Nginx Proxy Manager (npm), following the guide from here: https://tinyauth.app/docs/guides/nginx-proxy-manager

The on screen web shows:
An error occurred while trying to perform this action. Please check the console for more information

The log file shows:

2025-12-02T14:44:10Z INF cmd/root.go:118 > Starting Tinyauth version=v4.1.0
2025-12-02T14:44:10Z INF internal/service/oauth_broker_service.go:54 > Initialized OAuth service service=pocketid
2025-12-02T14:44:10Z INF internal/bootstrap/app_bootstrap.go:312 > Starting server on 0.0.0.0:3000
2025-12-02T14:44:18Z WRN internal/middleware/zerolog_middleware.go:62 > Client Error address=172.21.0.3:39484 client_ip=172.21.0.3 latency="124.619µs" method=GET path=/api/auth/nginx status=401
...
...
2025-12-02T14:44:18Z INF internal/middleware/zerolog_middleware.go:66 > Request address=172.21.0.3:39558 client_ip=192.168.x.x latency="35.28µs" method=GET path=/api/context/user status=200
2025-12-02T14:44:24Z ERR internal/controller/oauth_controller.go:150 > OAuth provider did not return an email

I can successfully log in using a username/password in the USERS file. This including 2FA.

I have tried with different proxied hosts on my npm. Same error.

My Pocket ID instance has emails verified for all users, and the user I am testing with has an email. I can see the correct data is there when looking at the OIDC Data Preview within Pocket ID.

The same error is happening even if I have:

all the services running in the same docker-compose file
or with containers installed via Unraid apps

I have tried the following:

all containers in the same docker-compose file
all on the same docker network
I've tried making new users on Pocket ID, with and without admin rights
adjusting the scope of PROVIDERS_POCKETID_SCOPES

Here is my custom config for my npm proxy clients, is there anything missing?
(copied from guide at tinyauth docs )

location / {
  # Pass the request to the app
  proxy_pass          $forward_scheme://$server:$port;

  # Add other app-specific config here

  # Tinyauth auth request
  auth_request /tinyauth;
  error_page 401 = @tinyauth_login;
}

# Tinyauth auth request
location /tinyauth {
  # Pass request to Tinyauth
  proxy_pass http://tinyauth:3000/api/auth/nginx;

  # Pass the request headers
  proxy_set_header x-forwarded-proto $scheme;
  proxy_set_header x-forwarded-host $http_host;
  proxy_set_header x-forwarded-uri $request_uri;
}

# Tinyauth login redirect
location @tinyauth_login {
  return 302 https://auth.REDACTED.com/login?redirect_uri=$scheme://$http_host$request_uri; # Replace with your app URL
}

To Reproduce
Steps to reproduce the behavior:
Install Pocket ID and Tinyauth with typical config

Expected behavior
Pocket ID log in works, passes data to Tinyauth and proceeds

Screenshots
As above, let me know if you need more.

Logs

2025-12-02T14:44:10Z INF cmd/root.go:118 > Starting Tinyauth version=v4.1.0
2025-12-02T14:44:10Z INF internal/service/oauth_broker_service.go:54 > Initialized OAuth service service=pocketid
2025-12-02T14:44:10Z INF internal/bootstrap/app_bootstrap.go:312 > Starting server on 0.0.0.0:3000
2025-12-02T14:44:18Z WRN internal/middleware/zerolog_middleware.go:62 > Client Error address=172.21.0.3:39484 client_ip=172.21.0.3 latency="124.619µs" method=GET path=/api/auth/nginx status=401
...
...
2025-12-02T14:44:18Z INF internal/middleware/zerolog_middleware.go:66 > Request address=172.21.0.3:39558 client_ip=192.168.x.x latency="35.28µs" method=GET path=/api/context/user status=200
2025-12-02T14:44:24Z ERR internal/controller/oauth_controller.go:150 > OAuth provider did not return an email

Device (please complete the following information):

OS: Unraid 7.2.1 - I've tried both [community apps as containers] and [docker-compose]
Browser [firefox, chrome]
Tinyauth [v4.1.0]
Docker [e.g. 27.5.1]
Pocket ID [1.16.0]

**
Additional context
Add any other context about the problem here.

Can you please provide your docker compose file and the logs in LOG_LEVEL=trace?

Please be careful when posting logs in trace as they contain a lot of sensitive information, I only need the log line that says Userinfo response body.

Can you please provide your docker compose file and the logs in LOG_LEVEL=trace?

Please be careful when posting logs in trace as they contain a lot of sensitive information, I only need the log line that says Userinfo response body.

My compose file:

services:
  tinyauth:
    container_name: tinyauth
    image: ghcr.io/steveiliop56/tinyauth:v4
    restart: unless-stopped
    environment:
      - APP_URL=https://auth.REDACTED.com
      - USERS=admin:aaaaaaaaaaaabbbbbbbbbbbbbbbbbbccccccccccccccccc
      - PROVIDERS_POCKETID_CLIENT_ID=aaaabbbbcccc
      - PROVIDERS_POCKETID_CLIENT_SECRET=aaaabbbbcccc
      - PROVIDERS_POCKETID_AUTH_URL=https://id.REDACTED.com/authorize
      - PROVIDERS_POCKETID_TOKEN_URL=https://id.REDACTED.com/api/oidc/token
      - PROVIDERS_POCKETID_USER_INFO_URL=https://id.REDACTED.com/api/oidc/userinfo
      - PROVIDERS_POCKETID_REDIRECT_URL=https://auth.REDACTED.com/api/oauth/callback/pocketid
      - PROVIDERS_POCKETID_NAME=Pocket ID
      - PROVIDERS_POCKETID_SCOPES=admins
      # - OAUTH_AUTO_REDIRECT=pocketid
      - LOG_LEVEL=trace
    networks:
      - mynetwork
    labels:
      tinyauth.apps.myapphere.oauth.groups: admins # testing groups
      
networks:
  mynetwork:
    external: true # Declare the network as pre-existing

My logs:


2025-12-03T17:19:16Z INF internal/middleware/zerolog_middleware.go:66 > Request address=172.21.0.6:41776 client_ip=192.168.2.101 latency="99.089µs" method=GET path=/api/oauth/url/pocketid status=200
2025-12-03T17:19:21Z DBG internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2025-12-03T17:19:21Z DBG internal/service/auth_service.go:365 > No basic auth provided
2025-12-03T17:19:21Z DBG internal/middleware/context_middleware.go:110 > No basic auth provided
2025-12-03T17:19:21Z TRC internal/service/generic_oauth_service.go:118 > Userinfo response body body="{\"sub\":\"7e5c8d9e-63c3-4923-9bb1-9c79052cfb1f\"}"
2025-12-03T17:19:21Z ERR internal/controller/oauth_controller.go:150 > OAuth provider did not return an email
2025-12-03T17:19:21Z INF internal/middleware/zerolog_middleware.go:66 > Request address=172.21.0.6:58408 client_ip=192.168.2.101 latency=16.752837ms method=GET path=/api/oauth/callback/pocketid status=307
2025-12-03T17:19:21Z DBG internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2025-12-03T17:19:21Z DBG internal/service/auth_service.go:365 > No basic auth provided

In the above files, I've changed my domain to redacted, and changed my local IP, e.g 192.168.x.x

Thanks steveiliop56.

Ah I see the issue. You are missing the required scopes. Please check the documentation. Basically you need:

services:
  tinyauth:
    environment:
      - PROVIDERS_POCKETID_SCOPES=openid email profile groups

Oh wow, my fault! That works now I've put the literal text:
openid email profile groups for the variable PROVIDERS_POCKETID_SCOPES.

So this variable is looking for space separated scopes.

I (incorrectly) thought this variable was looking for the names of the groups within Pocket ID "Manage User Groups".

I have a group called admins which I had set for that variable.

My fault, I've incorrectly read the docs.

Thanks Stavros, loving Tinyauth so far! Keep up the good work!

Fixed and closed.

Navigation Menu

Repository navigation

[BUG] Pocket ID won't work to log in - "OAuth provider did not return an email" #491

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[BUG] Pocket ID won't work to log in - "OAuth provider did not return an email" #491

Description

Activity

steveiliop56 commented on Dec 3, 2025

slater-uk commented on Dec 3, 2025

steveiliop56 commented on Dec 4, 2025

slater-uk commented on Dec 4, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions