Authentik OAuth login results in 502 Bad Gateway after callback

[b3nd1k]

I configured Authentik OAuth authentication with Bonds. The OAuth login flow appears to complete successfully, but after the callback the browser shows 502 Bad Gateway.

OAuth callback configured in Authentik:
https://people.mydomain.com/api/auth/Authentik/callback

What happens:
1. Click Sign in with Authentik
2. Authentik login page appears
3. Login succeeds
4. Redirect goes to /api/auth/Authentik/callback?code=...&state=...
5. Browser shows 502 Bad Gateway

Example callback URL:
https://people.mydomain.com/api/auth/Authentik/callback?code=...&state=...

Bonds logs show the callback being processed and returning 307, including finding the Authentik token, finding the user, updating the OAuth token, and reading app.url. After that redirect, the browser receives the 502 error.

Is there anything specific that needs to be configured for Authentik OAuth in Bonds? The callback appears to succeed but the final redirect fails.

[naiba]

Thanks for reporting this.

I reviewed the OAuth callback flow in detail. The code correctly:

1. Validates the provider via goth.GetProvider(provider)
2. Completes auth via gothic.CompleteUserAuth
3. Finds/creates the user via FindOrCreateUser
4. Redirects to {app.url}/auth/callback?token=xxx

The 502 is happening after Bonds returns the 307 redirect, which means the issue is in the reverse proxy layer, not in Bonds itself.

Most likely causes:

1. app.url is set incorrectly — Go to Admin → System Settings → Application and verify app.url is your public-facing URL (e.g. https://people.mydomain.com), not an internal address like http://localhost:8080.

2. Reverse proxy doesn't handle the redirect target — When Bonds returns 307 → https://people.mydomain.com/auth/callback?token=xxx, your reverse proxy needs to serve the frontend at that path. Make sure your nginx/caddy config proxies /auth/callback to the frontend (or to Bonds if using the embedded frontend).

Debugging steps:

• Check your app.url value in Admin → System Settings
• Check your reverse proxy logs at the moment of the 502
• Try accessing https://people.mydomain.com/auth/callback?token=test directly to see if the frontend loads

If the issue persists after verifying these, please share your reverse proxy config (nginx/caddy/traefik) and I can help debug further.