The Problem:
You’re receiving the message: 'Invalid login: 535 Authentication failed' error when trying to set up email-based authentication in your Next.js application using NextAuth and Mailgun. This indicates a problem with your Mailgun SMTP credentials or configuration within your NextAuth setup.
Understanding the “Why” (The Root Cause):
The 535 Authentication failed error from Mailgun typically means that the username or password you’re providing doesn’t match what Mailgun has on record for your account. Several common mistakes lead to this:
-
Incorrect SMTP Username: The most frequent cause is an incorrectly formatted SMTP username. You must use the full address that Mailgun generates for your domain, which is usually in the format postmaster@[your_mailgun_domain]. Using [email protected] (as in your example) is almost certainly wrong. Mailgun creates a unique domain for each user, and this is what needs to be used. Failure to do this is a common source of authentication errors.
-
Wrong API Key: Mailgun provides different API keys for various purposes. You need the SMTP API key, not a general API key or a webhook key. Confirm you are using the correct key type from your Mailgun account’s API Keys section.
-
Unverified Mailgun Domain: If your Mailgun domain isn’t fully verified, authentication may fail even with the correct credentials. Ensure your domain is properly verified in your Mailgun dashboard. Look for any outstanding steps or warnings related to DNS record verification.
-
Incorrect Port or TLS Settings: While port 587 is common, Mailgun might require adjustments to your TLS settings depending on your region and server configuration.
Step-by-Step Guide:
Step 1: Verify and Correct Mailgun Credentials:
- Locate the Correct Username: Go to your Mailgun dashboard, find your domain settings, and locate the correct SMTP username. It will look like
postmaster@<your_mailgun_domain>.com or similar. This is crucial. Do not use your primary domain (mysite.com in your example).
- Obtain the SMTP API Key: In your Mailgun dashboard, navigate to “API Keys” and ensure you are copying the SMTP API key, not the HTTP API key or any other.
Step 2: Update your .env file:
Replace the values in your .env file with the corrected username and API key obtained in Step 1:
SMTP_HOST="smtp.mailgun.org" # Or smtp.eu.mailgun.org if you're in the EU region.
SMTP_PORT="587"
SMTP_USERNAME="postmaster@<your_mailgun_domain>.com" #Corrected Username
SMTP_API_KEY="key-<your_actual_mailgun_api_key>" #Corrected API Key
FROM_EMAIL="<your_approved_sender>@<your_mailgun_domain>.com" #Ensure this matches your verified Mailgun domain
Step 3: Verify Mailgun Domain Verification:
- Log in to your Mailgun dashboard.
- Go to the Domains section and check the status of your domain. Ensure there are no warnings or pending verification steps.
- If there are any pending DNS records, add them to your DNS settings and wait for propagation (this can take some time).
Step 4 (If necessary): Adjust TLS Settings:
If you still face issues, try modifying your EmailProvider configuration in next-auth.js to explicitly control the TLS settings:
EmailProvider({
server: {
host: process.env.SMTP_HOST,
port: process.env.SMTP_PORT,
auth: {
user: process.env.SMTP_USERNAME,
pass: process.env.SMTP_API_KEY,
},
secure: true, // Or false depending on your port and Mailgun settings.
tls: {
rejectUnauthorized: false, //Consider setting to true for production environment
},
},
from: process.env.FROM_EMAIL,
maxAge: 600,
}),
Common Pitfalls & What to Check Next:
FROM_EMAIL Domain: Verify that the domain specified in FROM_EMAIL is the same as the verified domain in your Mailgun settings. Mailgun often rejects emails from unverified domains.- Double-Check for Typos: Carefully review all your environment variables. A single typo can cause authentication failure.
- Mailgun Sandbox Limitations: If you’re using a sandbox account, check your sending limits and ensure you haven’t exceeded them.
- Port Conflicts: If using port 587 is causing persistent issues, try alternate ports (e.g., 465, but remember to adjust the
secure flag accordingly).
- NextAuth Version: Ensure you’re using a reasonably recent version of NextAuth; older versions might have compatibility problems with Mailgun.
Still running into issues? Share your (sanitized) config files, the exact command you ran, and any other relevant details. The community is here to help!