signIn server action fails with Configuration error on Next.js 16

Environment

  System:
    OS: Windows 11 10.0.26200
    CPU: (16) x64 AMD Ryzen 7 4800H with Radeon Graphics
  Binaries:
    Node: 24.11.1
    npm: 11.6.2
  npmPackages:
    next: 16.1.6
    next-auth: 5.0.0-beta.30
    react: 19.2.3

Reproduction URL

https://github.com/TaylorBurke/nextauth-nextjs16-repro

Describe the issue

The signIn server action exported from NextAuth() fails with a Configuration error on Next.js 16. The HTTP handler (handlers.GET/handlers.POST) works correctly for the same request.

The reproduction is a minimal Next.js 16 app with a single GitHub OAuth provider:

// src/lib/auth.ts
import NextAuth from 'next-auth'
import GitHub from 'next-auth/providers/github'

export const { handlers, auth, signIn, signOut } = NextAuth({
  basePath: '/api/auth',
  providers: [GitHub],
})

The login page uses the documented server action pattern:

import { signIn } from '@/lib/auth'

<form action={async () => {
  'use server'
  await signIn('github', { redirectTo: '/' })
}}>
  <button type="submit">Sign in with GitHub</button>
</form>

Clicking the button redirects to the error page with ?error=Configuration instead of redirecting to GitHub OAuth.

What works:

• GET /api/auth/csrf — returns CSRF token
• GET /api/auth/providers — returns providers
• GET /api/auth/session — returns null
• GET /api/auth/signin — renders built-in signin page (which uses direct form POST, not server actions)
• POST /api/auth/signin/github via curl with proper CSRF cookie — returns 302 to GitHub OAuth
• Calling Auth() directly with a manually constructed request — works

The issue is specifically in the signIn server action in next-auth/lib/actions.js, which constructs a synthetic request via createActionURL() and passes it to Auth(). Something in this request construction fails on Next.js 16. The error is caught in Auth() and converted to the generic Configuration type before redirecting.

The bug reproduces both on localhost (HTTP) and on Vercel (HTTPS).

Workaround: Use direct HTML form POST (the same pattern the built-in signin page at /api/auth/signin uses) with a client component that fetches the CSRF token browser-side.

How to reproduce

1. Clone the reproduction repo
2. Copy .env.example to .env.local and fill in GitHub OAuth credentials + a secret
3. npm install && npm run dev
4. Visit http://localhost:3000
5. Click "Sign in with GitHub (server action)"
6. Observe redirect to /api/auth/error?error=Configuration

For comparison, visit /api/auth/signin to see the built-in signin page — clicking "Sign in with GitHub" there works correctly because it uses direct form POST, not the server action.

Expected behavior

Clicking the server action sign-in button should redirect to GitHub's OAuth authorization page, the same way the built-in signin page and direct HTTP POST do.

Run the linked minimal reproduction with the listed GitHub OAuth setup, then inspect next-auth/lib/actions.js, especially the signIn server action and its createActionURL() request construction. Compare that synthetic request with the working direct HTTP POST and Auth() calls. Done means the server action redirects to GitHub OAuth instead of /api/auth/error?error=Configuration on Next.js 16.