Error constructing google authentication strategy: ${err}

Error message

Error constructing google authentication strategy: ${err}

What it means

strategyFactory wraps construction of the passport Google OAuth2 strategy in a try/catch and rethrows any construction failure with this prefix. It means the underlying google-auth-library/passport-google-oauth20 constructor threw while being instantiated with the provided clientId, clientSecret and callbackURL. The original error text is appended so you can see the real cause.

Source

Thrown at packages/backend-core/src/middleware/passport/sso/google.ts:72

    const { clientID, clientSecret } = config

    if (!clientID || !clientSecret) {
      throw new Error(
        "Configuration invalid. Must contain google clientID and clientSecret"
      )
    }

    const verify = buildVerifyFn(saveUserFn)
    return new GoogleStrategy(
      {
        clientID: config.clientID,
        clientSecret: config.clientSecret,
        callbackURL: callbackUrl,
      },
      verify
    )
  } catch (err: any) {
    throw new Error(`Error constructing google authentication strategy: ${err}`)
  }
}

export async function getCallbackUrl(config: GoogleInnerConfig) {
  return ssoCallbackUrl(ConfigType.GOOGLE, config)
}

View on GitHub (pinned to a81a902e9a)

Solutions

Check the appended original error text in the message to identify the underlying cause
Verify the Google OAuth provider config (clientId, clientSecret, callbackUrl) in the admin SSO settings is complete and valid
Re-create the OAuth client credentials in Google Cloud Console, ensuring the authorized redirect URI matches the computed callback URL
Confirm the installed passport-google-oauth20 version matches what the config object expects

Example fix

// before
await strategyFactory({ config: { clientID: "", clientSecret: "", callbackURL: "not-a-url" } })
// after
await strategyFactory({ config: { clientID: "1234.apps.googleusercontent.com", clientSecret: "GOCSPX-xxxx", callbackURL: "https://app.example.com/api/global/auth/google/callback" } })

Defensive patterns

Strategy: try-catch

Validate before calling

function validateGoogleConfig(config) {
  return Boolean(
    config &&
    typeof config.clientID === "string" && config.clientID.length > 0 &&
    typeof config.clientSecret === "string" && config.clientSecret.length > 0 &&
    typeof config.callbackURL === "string" &&
    /^https?:\/\//.test(config.callbackURL)
  )
}

Type guard

function isGoogleConfig(config): config is { clientID: string; clientSecret: string; callbackURL: string } {
  return typeof config?.clientID === "string" &&
    typeof config?.clientSecret === "string" &&
    typeof config?.callbackURL === "string"
}

Try / catch

try {
  const strategy = await strategyFactory({ config })
} catch (err) {
  if (String(err.message).startsWith("Error constructing google authentication strategy")) {
    // log err.message verbatim — the underlying cause is appended after the prefix
  }
}

Prevention

Validate clientId/clientSecret/callbackURL are non-empty and the callback is an absolute https URL before calling strategyFactory
Store SSO credentials through the admin UI rather than manual DB edits
Pin and test passport-google-oauth20 versions in CI after upgrades
Test the SSO login flow in staging whenever Google credentials are rotated

When it happens

Trigger: Calling strategyFactory with a malformed or missing clientId/clientSecret, an invalid callbackUrl shape, or a dependency-level failure inside new GoogleStrategy(config, verify) (e.g. missing constructor option required by the passport-google library version).

Common situations: SSO/Google OAuth provider configured in Budibase admin with an empty or wrong client secret; pasted config containing whitespace/newlines; upgrading passport-google-oauth20 so a previously-valid config option is rejected; callback URL not a valid absolute URL.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/fbb64f9f0a21a1d0. Report an issue: GitHub.