{"record":{"id":"94961b72c16f4db7","repo":"SigNoz/signoz","slug":"codeinvalidinput-94961b","errorCode":"CodeInvalidInput","errorMessage":"google: no id_token in token response","messagePattern":"google: no id_token in token response","errorType":"error_code","errorClass":"errors.SignozError","httpStatus":400,"severity":"error","filePath":"pkg/authn/callbackauthn/googlecallbackauthn/authn.go","lineNumber":119,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttoken, err := oauth2Config.Exchange(ctx, query.Get(\"code\"))\n\tif err != nil {\n\t\tvar retrieveError *oauth2.RetrieveError\n\t\tif errors.As(err, &retrieveError) {\n\t\t\ta.settings.Logger().ErrorContext(ctx, \"google: failed to get token\", errors.Attr(err), slog.String(\"error_description\", retrieveError.ErrorDescription), slog.String(\"body\", string(retrieveError.Body)))\n\t\t\treturn nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, \"google: failed to get token\").WithAdditional(retrieveError.ErrorDescription)\n\t\t}\n\n\t\ta.settings.Logger().ErrorContext(ctx, \"google: failed to get token\", errors.Attr(err))\n\t\treturn nil, errors.Newf(errors.TypeInternal, errors.CodeInternal, \"google: failed to get token\")\n\t}\n\n\trawIDToken, ok := token.Extra(\"id_token\").(string)\n\tif !ok {\n\t\treturn nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"google: no id_token in token response\")\n\t}\n\n\tverifier := oidcProvider.Verifier(&oidc.Config{ClientID: googleConfig.ClientID})\n\tidToken, err := verifier.Verify(ctx, rawIDToken)\n\tif err != nil {\n\t\ta.settings.Logger().ErrorContext(ctx, \"google: failed to verify token\", errors.Attr(err))\n\t\treturn nil, errors.Newf(errors.TypeForbidden, errors.CodeForbidden, \"google: failed to verify token\")\n\t}\n\n\tvar claims struct {\n\t\tName          string `json:\"name\"`\n\t\tEmail         string `json:\"email\"`\n\t\tEmailVerified bool   `json:\"email_verified\"`\n\t\tHostedDomain  string `json:\"hd\"`\n\t}\n\n\tif err := idToken.Claims(&claims); err != nil {\n\t\ta.settings.Logger().ErrorContext(ctx, \"google: missing or invalid claims\", errors.Attr(err))","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/authn/callbackauthn/googlecallbackauthn/authn.go#L101-L137","documentation":"Returned by the Google OAuth callback handler when the token exchange succeeds but the token response contains no id_token extra field. The Google login flow requires an OpenID Connect id_token to verify user identity, so its absence is treated as invalid input to the flow.","triggerScenarios":"Calling HandleCallback after a Google OAuth code exchange where token.Extra(\"id_token\") is missing or not a string. Typically happens when the access_type/offline or scope configuration causes Google to omit the id_token, or a custom endpoint returns an unexpected payload.","commonSituations":"Requesting only offline access / refresh-token flows without the openid/email scopes; misconfigured redirect URI or consent screen; Google workspace restricting OIDC; stale or hand-rolled token endpoints.","solutions":["Ensure the OIDC scopes include openid and email on the OAuth client used by the callback handler","Avoid forcing access_type=offline in a way that drops the id_token; verify the raw token response contains id_token","Log/inspect the token response extras to confirm Google is returning id_token, then fix client credentials/consent config"],"exampleFix":"// before\noauth2.Config{Scopes: []string{\"https://www.googleapis.com/auth/userinfo.email\"}}\n\n// after\noauth2.Config{Scopes: []string{oidc.ScopeOpenID, \"email\", \"profile\"}}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"principal, err := a.HandleCallback(ctx, w, r)\nif err != nil {\n    if strings.Contains(err.Error(), \"no id_token in token response\") {\n        // surface a login-retry screen; check OAuth client scopes\n        http.Redirect(w, r, \"/login?error=oidc\", http.StatusTemporaryRedirect)\n        return\n    }\n    return err\n}","preventionTips":["Always request oidc.ScopeOpenID plus email on the Google OAuth client","Smoke-test the callback in staging after any OAuth client config change"],"tags":["oauth","google","oidc","authentication","go"],"backgroundTag":"oauth-id-token-missing","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}