Freika/dawarich · critical · Auth::VerifyGoogleToken::InvalidToken

Google client IDs not configured

Error message

Google client IDs not configured

What it means

Raised by Auth::VerifyGoogleToken#call when none of GOOGLE_IOS_CLIENT_ID, GOOGLE_ANDROID_CLIENT_ID, or GOOGLE_OAUTH_CLIENT_ID is set in the environment. The validator needs at least one audience (OAuth client ID) to check the token against; with zero client IDs there is nothing to validate and the service refuses to proceed rather than accepting a token unverified.

Source

Thrown at app/services/auth/verify_google_token.rb:20

module Auth
  class VerifyGoogleToken
    class InvalidToken < StandardError; end

    def initialize(id_token, nonce: nil)
      @id_token = id_token
      @nonce = nonce
    end

    def call
      raise InvalidToken, 'blank token' if @id_token.blank?

      client_ids = [
        ENV['GOOGLE_IOS_CLIENT_ID'],
        ENV['GOOGLE_ANDROID_CLIENT_ID'],
        ENV['GOOGLE_OAUTH_CLIENT_ID']
      ].compact
      raise InvalidToken, 'Google client IDs not configured' if client_ids.empty?

      validator = GoogleIDToken::Validator.new
      claims = nil
      audience_error = nil

      client_ids.each do |client_id|
        claims = validator.check(@id_token, client_id)
        break if claims
      rescue GoogleIDToken::AudienceMismatchError => e
        audience_error = e
        next
      end

      raise InvalidToken, audience_error&.message || 'validator returned nil' if claims.nil?

      claims = claims.symbolize_keys
      verify_nonce!(claims)

View on GitHub (pinned to 97fad417c5)

Solutions

1. Set GOOGLE_OAUTH_CLIENT_ID (web client) and, if mobile sign-in is used, GOOGLE_IOS_CLIENT_ID / GOOGLE_ANDROID_CLIENT_ID to the OAuth 2.0 client IDs from Google Cloud Console > APIs & Services > Credentials.
2. Redeploy/restart the app processes (Sidekiq workers and web) so they pick up the new environment.
3. Verify at runtime: Rails runner 'puts ENV.keys.grep(/GOOGLE_/)' or a boot-time check that raises loudly when the list is empty.
4. Add the vars to .env.example / CI environment so future environments inherit them.

Example fix

# before: nothing set
# GOOGLE_OAUTH_CLIENT_ID is unset -> client_ids.compact empty -> raise

# after (docker-compose.yml / deployment env)
environment:
  GOOGLE_OAUTH_CLIENT_ID: "1234567890-abc.apps.googleusercontent.com"
  GOOGLE_IOS_CLIENT_ID: "1234567890-ios.apps.googleusercontent.com"
  GOOGLE_ANDROID_CLIENT_ID: "1234567890-and.apps.googleusercontent.com"

# config/initializers/google_auth.rb
client_ids = %w[GOOGLE_IOS_CLIENT_ID GOOGLE_ANDROID_CLIENT_ID GOOGLE_OAUTH_CLIENT_ID].map { |k| ENV[k] }.compact
if Rails.env.production? && client_ids.empty?
  Rails.logger.error('No Google client IDs configured - Google sign-in disabled')
end

When it happens

Trigger: Deploying the app without the GOOGLE_OAUTH_CLIENT_ID env var (or its iOS/Android siblings), running the service in a new environment (staging, CI, container) that was seeded from a partial .env, or a typo in the variable name so all three read nil and .compact yields an empty array.

Common situations: Missing/duplicated env var in docker-compose or Kubernetes manifests, values defined only in .env.local so production lacks them, an env var set to an empty string (compact removes nil but blank strings remain — verify they are actually present), rotating Google OAuth client IDs and forgetting to update the deployment.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• client_id not configured
• blank token
• validator returned nil
• nonce mismatch
• blank token

AI-assisted analysis of Freika/dawarich@97fad417c5 (2026-08-21). Data as JSON: /api/errors/8ac58e0e5853efe2. Report an issue: GitHub.