googleapis/mcp-toolbox · error
tokeninfo endpoint returned non-OK status %d: %s
Error message
tokeninfo endpoint returned non-OK status %d: %s
What it means
The tokeninfo endpoint replied with a non-200 status (body included in the message) — the ADC token was rejected, expired, or the request was otherwise refused by Google's OAuth infrastructure.
Source
Thrown at internal/sources/util.go:104
client, err := google.DefaultClient(ctx,
"https://www.googleapis.com/auth/userinfo.email")
if err != nil {
return "", fmt.Errorf("failed to call userinfo endpoint: %w", err)
}
// Retrieve the email associated with the token
resp, err := client.Get("https://oauth2.googleapis.com/tokeninfo")
if err != nil {
return "", fmt.Errorf("failed to call tokeninfo endpoint: %w", err)
}
defer resp.Body.Close()
bodyBytes, err := io.ReadAll(resp.Body)
if err != nil {
return "", fmt.Errorf("error reading response body %d: %s", resp.StatusCode, string(bodyBytes))
}
if resp.StatusCode != http.StatusOK {
return "", fmt.Errorf("tokeninfo endpoint returned non-OK status %d: %s", resp.StatusCode, string(bodyBytes))
}
// Unmarshal response body and get `email`
var responseJSON map[string]any
err = json.Unmarshal(bodyBytes, &responseJSON)
if err != nil {
return "", fmt.Errorf("error parsing JSON: %v", err)
}
emailValue, ok := responseJSON["email"]
if !ok {
return "", fmt.Errorf("email not found in response: %v", err)
}
fullEmail, ok := emailValue.(string)
if !ok {
return "", fmt.Errorf("email field is not a string")View on GitHub (pinned to 8cc6e09de2)
Solutions
- Refresh Application Default Credentials
- Check the response body in the error for the specific OAuth failure
- Verify the credential has the userinfo.email scope
Defensive patterns
Strategy: retry
When it happens
Trigger: Thrown at internal/sources/util.go:104 when the library encounters an invalid state.
Common situations: See trigger scenarios.
AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05).
Data as JSON: /api/errors/24639b9b67ee3d9f.
Report an issue: GitHub.