git-ecosystem/git-credential-manager · error · InvalidOperationException

Invalid response from GitHub OIDC token endpoint: 'value'…

Error message

Invalid response from GitHub OIDC token endpoint: 'value' property is null.

What it means

A companion to the missing-'value' case: the GitHub OIDC token response did contain a 'value' property but it was JSON null, so GetString() returns null and the ?? throw fires. The endpoint responded 200 but with an empty token value.

Solutions

1. Inspect the traced 'OIDC token response:' payload to confirm what 'value' contained
2. Re-run the workflow — transient GitHub issues can cause malformed responses
3. Verify audience and request URL are valid so GitHub returns a real token string
4. If persistent, pin/update actions and GCM version, and report with the traced payload

Example fix

// before: assumes value is a string
return tokenElement.GetString() ?? throw ...;
// after: validate kind first
if (tokenElement.ValueKind != JsonValueKind.String || string.IsNullOrEmpty(token = tokenElement.GetString()))
    throw new InvalidOperationException("GitHub OIDC token response 'value' is not a non-empty string.");
return token;

using var doc = JsonDocument.Parse(json);
if (doc.RootElement.TryGetProperty("value", out var v) && v.ValueKind == JsonValueKind.String && !string.IsNullOrEmpty(v.GetString()))
    return v.GetString(); // else handle before calling GCM

bool HasNonNullToken(JsonElement el) => el.ValueKind == JsonValueKind.String && !string.IsNullOrEmpty(el.GetString());

try { /* entra auth */ }
catch (InvalidOperationException ex) when (ex.Message.Contains("'value' property is null")) { /* inspect traced response, re-run */ }

When it happens

Trigger: GetGitHubOidcToken: jsonDoc.RootElement.TryGetProperty("value", ...) succeeds but tokenElement.GetString() is null because the response contained {"value": null} or the property is not a string (e.g. an object), causing null coalescing to throw.

Common situations: GitHub returned a malformed/edge-case response; the 'value' property is an unexpected JSON type; intermediate proxies rewrite the response body; rare GitHub service issues.

Related errors

• Invalid response from GitHub OIDC token endpoint: 'value'…

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/301f856ab22016e4. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs:150

            string error = await response.Content.ReadAsStringAsync();
            Context.Trace.WriteLine(
                $"Failed to acquire GitHub OIDC token [{response.StatusCode:D} {response.StatusCode}]: {error}");
            response.EnsureSuccessStatusCode();
        }

        string json = await response.Content.ReadAsStringAsync();

        try
        {
            using JsonDocument jsonDoc = JsonDocument.Parse(json);
            if (!jsonDoc.RootElement.TryGetProperty("value", out JsonElement tokenElement))
            {
                throw new InvalidOperationException(
                    "Invalid response from GitHub OIDC token endpoint: 'value' property not found.");
            }

            return tokenElement.GetString() ??
                   throw new InvalidOperationException(
                       "Invalid response from GitHub OIDC token endpoint: 'value' property is null.");
        }
        catch (Exception ex)
        {
            Context.Trace.WriteException(ex);
            Context.Trace.WriteLine($"OIDC token response: {json}");
            throw;
        }
    }
}

View on GitHub (pinned to e8ce762cd0)