{"record":{"id":"989bf8796c6be515","repo":"medusajs/medusa","slug":"id-token-is-missing-sub-claim-989bf8","errorCode":null,"errorMessage":"id_token is missing 'sub' claim","messagePattern":"id_token is missing 'sub' claim","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/modules/providers/auth-google/src/services/google.ts","lineNumber":207,"sourceCode":"        throw new Error(\"Invalid id_token\")\n      }\n      payload = decoded\n    } catch (err) {\n      throw new MedusaError(\n        MedusaError.Types.UNAUTHORIZED,\n        `Could not verify Google id_token: ${err.message}`\n      )\n    }\n\n    if (!payload.email_verified) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"Email not verified, cannot proceed with authentication\"\n      )\n    }\n\n    if (!payload.sub) {\n      throw new MedusaError(\n        MedusaError.Types.INVALID_DATA,\n        \"id_token is missing 'sub' claim\"\n      )\n    }\n\n    const entity_id = payload.sub\n    const userMetadata = {\n      name: payload.name,\n      email: payload.email,\n      picture: payload.picture,\n      given_name: payload.given_name,\n      family_name: payload.family_name,\n    }\n\n    let authIdentity\n\n    try {\n      authIdentity = await authIdentityService.retrieve({","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/providers/auth-google/src/services/google.ts#L189-L225","documentation":"The provider requires the id_token's standard `sub` (subject) claim to identify the Google user. If it is absent, verify_ throws INVALID_DATA because there is no stable entity id to create or match the auth identity against.","triggerScenarios":"An id_token that verifies but lacks `sub`, typically from a non-standard token source or an unexpected token shape.","commonSituations":"Manually crafting tokens in tests, pointing the provider at a non-Google issuer, or Google emitting a token without sub in edge cases. Very rare in normal flows.","solutions":["Ensure the id_token comes from a genuine Google OAuth flow (it will always carry sub)","In tests, mint tokens that include a sub claim","Discard any custom flow that passes arbitrary JWTs as id_token"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await provider.validateCallback(query) } catch (e) { if (/missing 'sub'/.test(e.message)) res.redirect('/login?error=invalid_token') else throw e }","preventionTips":["Only feed genuine Google-issued id_tokens to the provider","Include sub in test fixtures' minted tokens"],"tags":["google","oauth","jwt","id-token","claims"],"backgroundTag":"jwt-missing-claim","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}