Pocket-id - Scope is required

[Boss-man]

hi all

I actually dont know if this is a tinyauth or a pocket-id problem.

I have tinyauth and pocket-id installed in an LXC thru the proxmox helper scripts.
Tinyauth in itself is working with user/pass config. But I would like to use passkeys with pocket-id.

I followed the guides on tinyauth, and got pocket-id linked with tinyauth thru Nginx Proxy Manager.
But when logging in with pocket-id I get an error "Scope is required"

Where did I go wrong ? Can anyone help me ?

[steveiliop56]

Hello,

You probably forgot to include the OAuth scopes config. Can you please share your configuration?

[Boss-man]

This is the tinyauth .env file, slightly redacted

auth.domain.com is tinyauth
authid.domain.com is pocket-id

DATABASE_PATH=/opt/tinyauth/database.db
APP_URL=https://auth.domain.com
PROVIDERS_POCKETID_CLIENT_ID=secret-client-id
PROVIDERS_POCKETID_CLIENT_SECRET=secret-client-secret
PROVIDERS_POCKETID_AUTH_URL=https://authid.domain.com/authorize
PROVIDERS_POCKETID_TOKEN_URL=https://authid.domain.com/api/oidc/token
PROVIDERS_POCKETID_USER_INFO_URL=https://authid.domain.com/api/oidc/userinfo
PROVIDERS_POCKETID_REDIRECT_URL=https://auth.domain.com/api/oauth/callback/pocketid
PROVIDERS_POCKETID_SCOPES=openid email profile groups
PROVIDERS_POCKETID_NAME=Pocket ID

And this is from NPM advanced tab on my test site:

# Root location
location / {
  # Pass the request to the app
  proxy_pass          $forward_scheme://$server:$port;

  # Add other app-specific config here

  # Tinyauth auth request
  auth_request /tinyauth;
  error_page 401 = @tinyauth_login;
}

# Tinyauth auth request
location /tinyauth {
  # Pass request to Tinyauth
  proxy_pass http://192.168.1.120:3000/api/auth/nginx;

  # Pass the request headers
  proxy_set_header x-forwarded-proto $scheme;
  proxy_set_header x-forwarded-host $http_host;
  proxy_set_header x-forwarded-uri $request_uri;
}

# Tinyauth login redirect
location @tinyauth_login {
  return 302 http://auth.domain.com/login?redirect_uri=$scheme://$http_host$request_uri; # Replace with your app URL
}

[Boss-man]

Just tried to do the same setup of tinyauth in docker, and there it works :)

Will try to set it up again in the LXC.

[steveiliop56]

As a first debug setup, you could try enclosing everything in quotes (") to ensure that they are being passed correctly to Tinyauth. There is a chance that your shell misinterprets them.

[Boss-man]

Thanks. That did the trick.
Everything seems to work now.

It probably didn't like the spaces in the scopes variable, as it seem the other variables was working.