googleapis/mcp-toolbox · error

`audience` is not allowed when `mcpEnabled` is false

Error message

`audience` is not allowed when `mcpEnabled` is false

What it means

When McpEnabled is false, the Google auth service runs in plain (non-MCP) mode where an explicit audience is not supported; Config.Initialize rejects any configured audience with this error. It is a strict config-validation guard to prevent silently ignored settings.

Source

Thrown at internal/auth/google/google.go:63

// Returns the auth service type
func (cfg Config) AuthServiceConfigType() string {
	return AuthServiceType
}

func (cfg Config) IsMCPEnabled() bool {
	return cfg.McpEnabled
}

// Initialize a Google auth service
func (cfg Config) Initialize() (auth.AuthService, error) {
	if cfg.McpEnabled {
		if cfg.Audience == "" && cfg.ClientID == "" {
			return nil, fmt.Errorf("`audience` or `clientId` is required when `mcpEnabled` is true")
		}
	} else {
		if cfg.Audience != "" {
			return nil, fmt.Errorf("`audience` is not allowed when `mcpEnabled` is false")
		}
		if len(cfg.ScopesRequired) > 0 {
			return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
		}
	}
	httpClient := &http.Client{
		Timeout: 10 * time.Second,
		Transport: &http.Transport{
			ForceAttemptHTTP2:     true,
			MaxIdleConns:          10,
			IdleConnTimeout:       90 * time.Second,
			TLSHandshakeTimeout:   5 * time.Second,
			ExpectContinueTimeout: 1 * time.Second,
		},
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Remove the audience field from the google auth config
2. Or set mcpEnabled: true if you actually need MCP audience validation
3. Move the audience value to clientId if the intent was to verify client identity

Example fix

// before
authServices:
  google:
    kind: google
    mcpEnabled: false
    audience: my-app.apps.googleusercontent.com
// after
authServices:
  google:
    kind: google
    mcpEnabled: false

if !cfg.McpEnabled && cfg.Audience != "" {
    return errors.New("google auth: audience requires mcpEnabled: true")
}

svc, err := cfg.Initialize()
if err != nil {
    if strings.Contains(err.Error(), "audience` is not allowed") {
        cfg.McpEnabled = true // or clear cfg.Audience, then retry
        svc, err = cfg.Initialize()
    }
}

When it happens

Trigger: YAML config with kind: google, mcpEnabled: false (or omitted) while also setting an audience field; building Config{McpEnabled: false, Audience: "..."} in code.

Common situations: Switching from MCP mode back to default mode and leaving the audience field behind; template configs that include audience unconditionally.

Related errors

• `audience` or `clientId` is required when `mcpEnabled` is tr
• `scopesRequired` is not allowed when `mcpEnabled` is false
• google ID token verification failure: %w
• failed to create Google tokeninfo request: %w
• failed to read Google tokeninfo response: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/c1ba7f93d781709d. Report an issue: GitHub.