{"record":{"id":"5d30bdd950c96625","repo":"medusajs/medusa","slug":"id-token-is-missing-sub-claim","errorCode":null,"errorMessage":"id_token is missing 'sub' claim","messagePattern":"id_token is missing 'sub' claim","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/auth/src/providers/medusa-cloud-auth.ts","lineNumber":224,"sourceCode":"        throw new Error(\"Invalid id_token\")\n      }\n      payload = decoded\n    } catch (err) {\n      return {\n        success: false,\n        error: `Could not verify id_token: ${err.message}`,\n      }\n    }\n\n    if (!payload.email_verified) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"Email not verified, cannot proceed with authentication\"\n      )\n    }\n\n    if (!payload.sub) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"id_token is missing 'sub' claim\"\n      )\n    }\n\n    const entity_id = payload.sub\n    const userMetadata = {\n      name: payload.name,\n      email: payload.email,\n      picture: payload.picture,\n      given_name: payload.given_name,\n      family_name: payload.family_name,\n    }\n\n    let authIdentity\n\n    try {\n      authIdentity = await authIdentityService.retrieve({","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/providers/medusa-cloud-auth.ts#L206-L242","documentation":"The decoded and signature-verified id_token from Medusa Cloud is missing the 'sub' (subject) claim, which the provider uses as the entity id for the auth identity. Without it the identity cannot be mapped, so authentication aborts.","triggerScenarios":"validateCallback receives an id_token whose payload lacks 'sub' — typically a misconfigured or nonstandard token issued by the identity provider, or a hand-crafted/debug token used in tests.","commonSituations":"Custom IdP configurations that drop standard OIDC claims; stale test fixtures with truncated JWTs; IdP version/config change that altered token claims.","solutions":["Inspect the id_token payload (decode the middle segment) to confirm which claims are present","Fix the IdP/Cloud configuration so standard OIDC 'sub' is included in issued tokens","If testing, use a properly formatted JWT containing sub and email_verified"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await validateCallback(...) } catch (e) { if (e.message.includes(\"missing 'sub'\")) { /* flag IdP token config issue */ } throw e }","preventionTips":["Use well-formed OIDC tokens containing sub in test fixtures","Audit custom IdP claim mappings after upgrades"],"tags":["auth","jwt","oidc"],"backgroundTag":"jwt-missing-claim","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}