{"record":{"id":"c1ba7f93d781709d","repo":"googleapis/mcp-toolbox","slug":"audience-is-not-allowed-when-mcpenabled-is-fal","errorCode":null,"errorMessage":"`audience` is not allowed when `mcpEnabled` is false","messagePattern":"`audience` is not allowed when `mcpEnabled` is false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/google/google.go","lineNumber":63,"sourceCode":"\n// Returns the auth service type\nfunc (cfg Config) AuthServiceConfigType() string {\n\treturn AuthServiceType\n}\n\nfunc (cfg Config) IsMCPEnabled() bool {\n\treturn cfg.McpEnabled\n}\n\n// Initialize a Google auth service\nfunc (cfg Config) Initialize() (auth.AuthService, error) {\n\tif cfg.McpEnabled {\n\t\tif cfg.Audience == \"\" && cfg.ClientID == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`audience` or `clientId` is required when `mcpEnabled` is true\")\n\t\t}\n\t} else {\n\t\tif cfg.Audience != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`audience` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif len(cfg.ScopesRequired) > 0 {\n\t\t\treturn nil, fmt.Errorf(\"`scopesRequired` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t}\n\thttpClient := &http.Client{\n\t\tTimeout: 10 * time.Second,\n\t\tTransport: &http.Transport{\n\t\t\tForceAttemptHTTP2:     true,\n\t\t\tMaxIdleConns:          10,\n\t\t\tIdleConnTimeout:       90 * time.Second,\n\t\t\tTLSHandshakeTimeout:   5 * time.Second,\n\t\t\tExpectContinueTimeout: 1 * time.Second,\n\t\t},\n\t\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\t\treturn http.ErrUseLastResponse\n\t\t},\n\t}","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/google/google.go#L45-L81","documentation":"When McpEnabled is false, the Google auth service runs in plain (non-MCP) mode where an explicit audience is not supported; Config.Initialize rejects any configured audience with this error. It is a strict config-validation guard to prevent silently ignored settings.","triggerScenarios":"YAML config with kind: google, mcpEnabled: false (or omitted) while also setting an audience field; building Config{McpEnabled: false, Audience: \"...\"} in code.","commonSituations":"Switching from MCP mode back to default mode and leaving the audience field behind; template configs that include audience unconditionally.","solutions":["Remove the audience field from the google auth config","Or set mcpEnabled: true if you actually need MCP audience validation","Move the audience value to clientId if the intent was to verify client identity"],"exampleFix":"// before\nauthServices:\n  google:\n    kind: google\n    mcpEnabled: false\n    audience: my-app.apps.googleusercontent.com\n// after\nauthServices:\n  google:\n    kind: google\n    mcpEnabled: false","handlingStrategy":"validation","validationCode":"if !cfg.McpEnabled && cfg.Audience != \"\" {\n    return errors.New(\"google auth: audience requires mcpEnabled: true\")\n}","typeGuard":null,"tryCatchPattern":"svc, err := cfg.Initialize()\nif err != nil {\n    if strings.Contains(err.Error(), \"audience` is not allowed\") {\n        cfg.McpEnabled = true // or clear cfg.Audience, then retry\n        svc, err = cfg.Initialize()\n    }\n}","preventionTips":["When toggling mcpEnabled, review and remove audience/scopesRequired fields","Keep separate config files for MCP and non-MCP modes","Lint YAML for mutually exclusive google auth fields before deploy","Comment config fields with their mode requirements"],"tags":["go","auth","google","config-validation"],"backgroundTag":"invalid-config-combination","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}