{"record":{"id":"28b9411906a4909b","repo":"medusajs/medusa","slug":"google-clientsecret-is-required","errorCode":null,"errorMessage":"Google clientSecret is required","messagePattern":"Google clientSecret is required","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"packages/modules/providers/auth-google/src/services/google.ts","lineNumber":46,"sourceCode":"const GOOGLE_JWKS_URI = \"https://www.googleapis.com/oauth2/v3/certs\"\nconst GOOGLE_ISSUERS = [\"https://accounts.google.com\", \"accounts.google.com\"]\n\ninterface LocalServiceConfig extends GoogleAuthProviderOptions {}\nexport class GoogleAuthService extends AbstractAuthModuleProvider {\n  static identifier = \"google\"\n  static DISPLAY_NAME = \"Google Authentication\"\n\n  protected config_: LocalServiceConfig\n  protected logger_: Logger\n  protected jwks_: JwksClient\n\n  static validateOptions(options: GoogleAuthProviderOptions) {\n    if (!options.clientId) {\n      throw new Error(\"Google clientId is required\")\n    }\n\n    if (!options.clientSecret) {\n      throw new Error(\"Google clientSecret is required\")\n    }\n\n    if (!options.callbackUrl) {\n      throw new Error(\"Google callbackUrl is required\")\n    }\n  }\n\n  constructor(\n    { logger }: InjectedDependencies,\n    options: GoogleAuthProviderOptions\n  ) {\n    // @ts-ignore\n    super(...arguments)\n    this.config_ = options\n    this.logger_ = logger\n    this.jwks_ = jwksClient({\n      jwksUri: GOOGLE_JWKS_URI,\n      cache: true,","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/providers/auth-google/src/services/google.ts#L28-L64","documentation":"The Google auth provider requires the OAuth client secret to exchange authorization codes for tokens. `validateOptions` throws at startup when `clientSecret` is missing.","triggerScenarios":"Configuring auth-google with clientId but no clientSecret, or GOOGLE_CLIENT_SECRET unset in the environment.","commonSituations":"Copying only the client id from Google Cloud Console, secret rotated/invalidated, or env var missing in production while present locally.","solutions":["Set clientSecret in provider options from GOOGLE_CLIENT_SECRET","Verify the value matches the current client secret shown in Google Cloud Console (regenerate if lost)"],"exampleFix":"// before\noptions: { clientId: process.env.GOOGLE_CLIENT_ID, callbackUrl }\n// after\noptions: { clientId: process.env.GOOGLE_CLIENT_ID, clientSecret: process.env.GOOGLE_CLIENT_SECRET, callbackUrl }","handlingStrategy":"validation","validationCode":"for (const k of ['GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET', 'MEDUSA_BACKEND_URL']) {\n  if (!process.env[k]) throw new Error(`Missing env var: ${k}`)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Group all Google provider env vars in one validation","Rotate secrets through the secret manager and redeploy"],"tags":["google","oauth","auth-provider","module-config","startup"],"backgroundTag":"oauth-provider-misconfigured","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}