googleapis/mcp-toolbox · error

`audience` or `clientId` is required when `mcpEnabled` is tr

Error message

`audience` or `clientId` is required when `mcpEnabled` is true

What it means

Google auth Config.Initialize enforces that when McpEnabled is true the config must identify an expected audience: either Audience or ClientID must be set. Without one, incoming Google ID tokens cannot be validated against the intended resource, so initialization fails immediately with this message.

Source

Thrown at internal/auth/google/google.go:59

	Audience       string   `yaml:"audience"`
	McpEnabled     bool     `yaml:"mcpEnabled"`
	ScopesRequired []string `yaml:"scopesRequired"`
}

// Returns the auth service type
func (cfg Config) AuthServiceConfigType() string {
	return AuthServiceType
}

func (cfg Config) IsMCPEnabled() bool {
	return cfg.McpEnabled
}

// Initialize a Google auth service
func (cfg Config) Initialize() (auth.AuthService, error) {
	if cfg.McpEnabled {
		if cfg.Audience == "" && cfg.ClientID == "" {
			return nil, fmt.Errorf("`audience` or `clientId` is required when `mcpEnabled` is true")
		}
	} else {
		if cfg.Audience != "" {
			return nil, fmt.Errorf("`audience` is not allowed when `mcpEnabled` is false")
		}
		if len(cfg.ScopesRequired) > 0 {
			return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
		}
	}
	httpClient := &http.Client{
		Timeout: 10 * time.Second,
		Transport: &http.Transport{
			ForceAttemptHTTP2:     true,
			MaxIdleConns:          10,
			IdleConnTimeout:       90 * time.Second,
			TLSHandshakeTimeout:   5 * time.Second,
			ExpectContinueTimeout: 1 * time.Second,
		},

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Add audience: <your-google-client-id-or-audience> to the google auth config
2. Or add clientId: <client-id> to the config
3. If MCP mode is not intended, set mcpEnabled: false instead

Example fix

// before
authServices:
  google:
    kind: google
    mcpEnabled: true
// after
authServices:
  google:
    kind: google
    mcpEnabled: true
    audience: my-app.apps.googleusercontent.com

if cfg.McpEnabled && cfg.Audience == "" && cfg.ClientID == "" {
    return errors.New("google auth: mcpEnabled requires audience or clientId")
}

svc, err := cfg.Initialize()
if err != nil {
    if strings.Contains(err.Error(), "audience` or `clientId` is required") {
        cfg.Audience = os.Getenv("GOOGLE_CLIENT_ID")
        svc, err = cfg.Initialize()
    }
}

When it happens

Trigger: YAML auth config with kind: google and mcpEnabled: true but no audience and no clientId field; programmatically building Config{McpEnabled: true} with empty Audience and ClientID.

Common situations: Copy-pasting a basic Google auth example and enabling MCP mode without adding audience; renaming fields and forgetting audience; environment-driven config where the audience variable is empty.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• `audience` is not allowed when `mcpEnabled` is false
• `scopesRequired` is not allowed when `mcpEnabled` is false
• google ID token verification failure: %w
• failed to create Google tokeninfo request: %w
• failed to read Google tokeninfo response: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/dfbb155d22e37b53. Report an issue: GitHub.