{"record":{"id":"7245ad24ea7f51b7","repo":"grpc/grpc-go","slug":"credentials-audience-cannot-be-empty","errorCode":null,"errorMessage":"credentials: audience cannot be empty","messagePattern":"credentials: audience cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/google/gcp_service_account_identity_credentials.go","lineNumber":103,"sourceCode":"// parameters cannot be empty.\n//\n// The credentials object starts asynchronous background token fetches to\n// refresh expired tokens. The provided context propagates cancellation to\n// these background tasks. Users should not pass an RPC-scoped context here,\n// but rather a context that is valid for the entire lifetime of the\n// credentials and should cancel the context when they are done.\n//\n// # Experimental\n//\n// Notice: This API is EXPERIMENTAL and may be changed or removed in a\n// later release.\nfunc NewServiceAccountIdentityCredentials(ctx context.Context, audience string) (credentials.PerRPCCredentials, error) {\n\tif ctx == nil {\n\t\treturn nil, fmt.Errorf(\"credentials: ctx cannot be nil\")\n\t}\n\n\tif audience == \"\" {\n\t\treturn nil, fmt.Errorf(\"credentials: audience cannot be empty\")\n\t}\n\n\tcreds, err := internal.NewIDTokenCredentials(&idtoken.Options{Audience: audience})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"credentials: failed to create ID token credentials: %v\", err)\n\t}\n\n\treturn &gcpServiceAccountIdentityCallCreds{\n\t\tctx:      ctx,\n\t\taudience: audience,\n\t\tcreds:    creds,\n\t\tbackoff:  internal.BackoffStrategy,\n\t}, nil\n}\n\n// GetRequestMetadata gets the current request metadata, refreshing tokens if\n// required. This implementation follows the PerRPCCredentials interface.\n//","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/credentials/google/gcp_service_account_identity_credentials.go#L85-L121","documentation":"NewServiceAccountIdentityCredentials returns this when the audience string is empty (gcp_service_account_identity_credentials.go:102-104). The audience becomes the aud claim of the ID token the metadata server mints; an empty one is rejected before any network call because the resulting token could not be validated by the receiving service.","triggerScenarios":"Calling google.NewServiceAccountIdentityCredentials(ctx, \"\") — audience loaded from a config/env var that was not set, a struct field left at its zero value, or a typo in the config key.","commonSituations":"Missing AUDIENCE env var in a deployment, a config loader that silently returns \"\" on missing keys, secret/manager integration not yet populated, or a staged rollout where the audience differs per env and one env forgot to set it.","solutions":["Provide a non-empty audience, typically the target service's URL or OIDC audience (e.g. https://service.example.com).","Fail your config loader loudly when the audience key is missing instead of defaulting to \"\".","Read the audience from a validated config struct with required-field checks at startup."],"exampleFix":"// before\ncreds, err := google.NewServiceAccountIdentityCredentials(ctx, os.Getenv(\"AUDIENCE\"))\n\n// after\naud := os.Getenv(\"AUDIENCE\")\nif aud == \"\" { log.Fatal(\"AUDIENCE required\") }\ncreds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)","handlingStrategy":"validation","validationCode":"aud := strings.TrimSpace(cfg.Audience)\nif aud == \"\" {\n    return nil, fmt.Errorf(\"configuration: audience is required\")\n}\ncreds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)","typeGuard":null,"tryCatchPattern":"creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)\nif err != nil && strings.Contains(err.Error(), \"audience cannot be empty\") {\n    // config error: ensure audience is sourced from a required config field.\n    return nil, fmt.Errorf(\"missing required audience in config: %w\", err)\n}","preventionTips":["Treat audience as a required config field with startup validation.","Fail config loading when the audience key is missing rather than defaulting to empty.","Document the expected audience format for each target service."],"tags":["grpc","credentials","gcp","validation","configuration","jwt"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}