What causes "credentials: audience cannot be empty" in grpc/grpc-go?

Provide a non-empty audience, typically the target service's URL or OIDC audience (e.g. https://service.example.com).

credentials: audience cannot be empty

Error message

credentials: audience cannot be empty

What it means

NewServiceAccountIdentityCredentials returns this when the audience string is empty (gcp_service_account_identity_credentials.go:102-104). The audience becomes the aud claim of the ID token the metadata server mints; an empty one is rejected before any network call because the resulting token could not be validated by the receiving service.

Source

Thrown at credentials/google/gcp_service_account_identity_credentials.go:103

// parameters cannot be empty.
//
// The credentials object starts asynchronous background token fetches to
// refresh expired tokens. The provided context propagates cancellation to
// these background tasks. Users should not pass an RPC-scoped context here,
// but rather a context that is valid for the entire lifetime of the
// credentials and should cancel the context when they are done.
//
// # Experimental
//
// Notice: This API is EXPERIMENTAL and may be changed or removed in a
// later release.
func NewServiceAccountIdentityCredentials(ctx context.Context, audience string) (credentials.PerRPCCredentials, error) {
	if ctx == nil {
		return nil, fmt.Errorf("credentials: ctx cannot be nil")
	}

	if audience == "" {
		return nil, fmt.Errorf("credentials: audience cannot be empty")
	}

	creds, err := internal.NewIDTokenCredentials(&idtoken.Options{Audience: audience})
	if err != nil {
		return nil, fmt.Errorf("credentials: failed to create ID token credentials: %v", err)
	}

	return &gcpServiceAccountIdentityCallCreds{
		ctx:      ctx,
		audience: audience,
		creds:    creds,
		backoff:  internal.BackoffStrategy,
	}, nil
}

// GetRequestMetadata gets the current request metadata, refreshing tokens if
// required. This implementation follows the PerRPCCredentials interface.
//

View on GitHub (pinned to 03255a9237)

Solutions

Provide a non-empty audience, typically the target service's URL or OIDC audience (e.g. https://service.example.com).
Fail your config loader loudly when the audience key is missing instead of defaulting to "".
Read the audience from a validated config struct with required-field checks at startup.

Example fix

// before
creds, err := google.NewServiceAccountIdentityCredentials(ctx, os.Getenv("AUDIENCE"))

// after
aud := os.Getenv("AUDIENCE")
if aud == "" { log.Fatal("AUDIENCE required") }
creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)

Defensive patterns

Strategy: validation

Validate before calling

aud := strings.TrimSpace(cfg.Audience)
if aud == "" {
    return nil, fmt.Errorf("configuration: audience is required")
}
creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)

Try / catch

creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)
if err != nil && strings.Contains(err.Error(), "audience cannot be empty") {
    // config error: ensure audience is sourced from a required config field.
    return nil, fmt.Errorf("missing required audience in config: %w", err)
}

Prevention

Treat audience as a required config field with startup validation.
Fail config loading when the audience key is missing rather than defaulting to empty.
Document the expected audience format for each target service.

When it happens

Trigger: Calling google.NewServiceAccountIdentityCredentials(ctx, "") — audience loaded from a config/env var that was not set, a struct field left at its zero value, or a typo in the config key.

Common situations: Missing AUDIENCE env var in a deployment, a config loader that silently returns "" on missing keys, secret/manager integration not yet populated, or a staged rollout where the audience differs per env and one env forgot to set it.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/7245ad24ea7f51b7. Report an issue: GitHub.