Prerequisites

• I have searched the repository’s issues and Kinde community to ensure my issue isn’t a duplicate
• I have checked the latest version of the library to replicate my issue
• I have read the contributing guidelines
• I agree to the terms within the code of conduct

Describe the issue

Description

When an unauthenticated request hits the /auth/portal route, the portal handler in src/handlers/portal.ts constructs a relative redirect URL:

if (!accessToken)
  return e.redirect(`${config.apiPath}/${routes.login}`);

This produces a relative path like /api/auth/login, which is then passed to AppRouterClient.redirect():

redirect(r) {
  return NextResponse.redirect(r);
}

NextResponse.redirect() requires an absolute URL. This throws:

Error: URL is malformed "/api/auth/login". Please use only absolute URLs

The protect handler correctly prepends KINDE_SITE_URL when building the redirect:

const u = new URL(`${process.env.KINDE_SITE_URL}/api/auth/${routes.login}?${params}`);

The portal handler should do the same.

Steps to reproduce

1. Configure handleAuth() with App Router at a custom API path (e.g. /api/auth/[kindeAuth])
2. Send an unauthenticated request to /api/auth/portal (e.g. curl -I https://your-app.com/api/auth/portal)
3. The handler crashes with Error: URL is malformed

Expected behaviour

The portal handler should redirect to an absolute URL (e.g. https://your-app.com/api/auth/login) or return a 401 if no token is presented, not crash with a 500.

Suggested fix

In src/handlers/portal.ts, change:

return e.redirect(`${config.apiPath}/${routes.login}`);

to:

return e.redirect(`${config.redirectURL}${config.apiPath}/${routes.login}`);

This matches how the protect handler already constructs its redirect URL.

Library URL

https://github.com/kinde-oss/kinde-auth-nextjs/

Library version

2.11.0

Operating system(s)

macOS

Operating system version(s)

26.5

Further environment details

Environment:

• Next.js 15 (App Router, standalone output)
• Node.js 24.13.0
• Deployed on AWS ECS Fargate behind CloudFront

Reproducible test case URL

No response

Additional information

No response