UntrustedHost: Host must be trusted. The URL was: This means your Amplify domain is not trusted by Auth.js, and the framework is rejecting any auth-related requests to/from it. This is a security feature introduced in newer versions of Auth.js to prevent SSR-based spoofing or replay attacks.