SigNoz/signoz · error · errors.SignozError

CodeInvalidInput

CodeInvalidInput

Error message

google: no id_token in token response

What it means

Returned by the Google OAuth callback handler when the token exchange succeeds but the token response contains no id_token extra field. The Google login flow requires an OpenID Connect id_token to verify user identity, so its absence is treated as invalid input to the flow.

Source

Thrown at pkg/authn/callbackauthn/googlecallbackauthn/authn.go:119

	if err != nil {
		return nil, err
	}

	token, err := oauth2Config.Exchange(ctx, query.Get("code"))
	if err != nil {
		var retrieveError *oauth2.RetrieveError
		if errors.As(err, &retrieveError) {
			a.settings.Logger().ErrorContext(ctx, "google: failed to get token", errors.Attr(err), slog.String("error_description", retrieveError.ErrorDescription), slog.String("body", string(retrieveError.Body)))
			return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "google: failed to get token").WithAdditional(retrieveError.ErrorDescription)
		}

		a.settings.Logger().ErrorContext(ctx, "google: failed to get token", errors.Attr(err))
		return nil, errors.Newf(errors.TypeInternal, errors.CodeInternal, "google: failed to get token")
	}

	rawIDToken, ok := token.Extra("id_token").(string)
	if !ok {
		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "google: no id_token in token response")
	}

	verifier := oidcProvider.Verifier(&oidc.Config{ClientID: googleConfig.ClientID})
	idToken, err := verifier.Verify(ctx, rawIDToken)
	if err != nil {
		a.settings.Logger().ErrorContext(ctx, "google: failed to verify token", errors.Attr(err))
		return nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, "google: failed to verify token")
	}

	var claims struct {
		Name          string `json:"name"`
		Email         string `json:"email"`
		EmailVerified bool   `json:"email_verified"`
		HostedDomain  string `json:"hd"`
	}

	if err := idToken.Claims(&claims); err != nil {
		a.settings.Logger().ErrorContext(ctx, "google: missing or invalid claims", errors.Attr(err))

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Ensure the OIDC scopes include openid and email on the OAuth client used by the callback handler
2. Avoid forcing access_type=offline in a way that drops the id_token; verify the raw token response contains id_token
3. Log/inspect the token response extras to confirm Google is returning id_token, then fix client credentials/consent config

Example fix

// before
oauth2.Config{Scopes: []string{"https://www.googleapis.com/auth/userinfo.email"}}

// after
oauth2.Config{Scopes: []string{oidc.ScopeOpenID, "email", "profile"}}

principal, err := a.HandleCallback(ctx, w, r)
if err != nil {
    if strings.Contains(err.Error(), "no id_token in token response") {
        // surface a login-retry screen; check OAuth client scopes
        http.Redirect(w, r, "/login?error=oidc", http.StatusTemporaryRedirect)
        return
    }
    return err
}

When it happens

Trigger: Calling HandleCallback after a Google OAuth code exchange where token.Extra("id_token") is missing or not a string. Typically happens when the access_type/offline or scope configuration causes Google to omit the id_token, or a custom endpoint returns an unexpected payload.

Common situations: Requesting only offline access / refresh-token flows without the openid/email scopes; misconfigured redirect URI or consent screen; Google workspace restricting OIDC; stale or hand-rolled token endpoints.

Related errors

• ErrCodeIncorrectPassword
• api_key_expired
• errors.CodeUnauthenticated
• errors.CodeUnauthenticated
• CodeTooManyRequests

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/94961b72c16f4db7. Report an issue: GitHub.