{"record":{"id":"dfbb155d22e37b53","repo":"googleapis/mcp-toolbox","slug":"audience-or-clientid-is-required-when-mcpenab","errorCode":null,"errorMessage":"`audience` or `clientId` is required when `mcpEnabled` is true","messagePattern":"`audience` or `clientId` is required when `mcpEnabled` is true","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/google/google.go","lineNumber":59,"sourceCode":"\tAudience       string   `yaml:\"audience\"`\n\tMcpEnabled     bool     `yaml:\"mcpEnabled\"`\n\tScopesRequired []string `yaml:\"scopesRequired\"`\n}\n\n// Returns the auth service type\nfunc (cfg Config) AuthServiceConfigType() string {\n\treturn AuthServiceType\n}\n\nfunc (cfg Config) IsMCPEnabled() bool {\n\treturn cfg.McpEnabled\n}\n\n// Initialize a Google auth service\nfunc (cfg Config) Initialize() (auth.AuthService, error) {\n\tif cfg.McpEnabled {\n\t\tif cfg.Audience == \"\" && cfg.ClientID == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`audience` or `clientId` is required when `mcpEnabled` is true\")\n\t\t}\n\t} else {\n\t\tif cfg.Audience != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`audience` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif len(cfg.ScopesRequired) > 0 {\n\t\t\treturn nil, fmt.Errorf(\"`scopesRequired` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t}\n\thttpClient := &http.Client{\n\t\tTimeout: 10 * time.Second,\n\t\tTransport: &http.Transport{\n\t\t\tForceAttemptHTTP2:     true,\n\t\t\tMaxIdleConns:          10,\n\t\t\tIdleConnTimeout:       90 * time.Second,\n\t\t\tTLSHandshakeTimeout:   5 * time.Second,\n\t\t\tExpectContinueTimeout: 1 * time.Second,\n\t\t},","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/google/google.go#L41-L77","documentation":"Google auth Config.Initialize enforces that when McpEnabled is true the config must identify an expected audience: either Audience or ClientID must be set. Without one, incoming Google ID tokens cannot be validated against the intended resource, so initialization fails immediately with this message.","triggerScenarios":"YAML auth config with kind: google and mcpEnabled: true but no audience and no clientId field; programmatically building Config{McpEnabled: true} with empty Audience and ClientID.","commonSituations":"Copy-pasting a basic Google auth example and enabling MCP mode without adding audience; renaming fields and forgetting audience; environment-driven config where the audience variable is empty.","solutions":["Add audience: <your-google-client-id-or-audience> to the google auth config","Or add clientId: <client-id> to the config","If MCP mode is not intended, set mcpEnabled: false instead"],"exampleFix":"// before\nauthServices:\n  google:\n    kind: google\n    mcpEnabled: true\n// after\nauthServices:\n  google:\n    kind: google\n    mcpEnabled: true\n    audience: my-app.apps.googleusercontent.com","handlingStrategy":"validation","validationCode":"if cfg.McpEnabled && cfg.Audience == \"\" && cfg.ClientID == \"\" {\n    return errors.New(\"google auth: mcpEnabled requires audience or clientId\")\n}","typeGuard":null,"tryCatchPattern":"svc, err := cfg.Initialize()\nif err != nil {\n    if strings.Contains(err.Error(), \"audience` or `clientId` is required\") {\n        cfg.Audience = os.Getenv(\"GOOGLE_CLIENT_ID\")\n        svc, err = cfg.Initialize()\n    }\n}","preventionTips":["Always pair mcpEnabled: true with audience or clientId in YAML templates","Validate config with a schema/CLI check before server startup","Source clientId/audience from env vars with a fail-fast startup check","Document required fields in your config examples"],"tags":["go","auth","google","config-validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}