What causes "Could not verify Google id_token: ${err.message}" in medusajs/medusa?

Ensure tokens come from the standard Google OAuth flow with the same client_id configured in the provider

medusajs/medusa · error · MedusaError

Could not verify Google id_token: ${err.message}

Error message

Could not verify Google id_token: ${err.message}

What it means

After the token exchange, the provider verifies and decodes Google's signed id_token with the strategy's JWT verification (JWKS-based). If decoding/verification throws, the provider wraps the failure in an UNAUTHORIZED MedusaError including the underlying message.

Source

Thrown at packages/modules/providers/auth-google/src/services/google.ts:193

    authIdentityService: AuthIdentityProviderService
  ) {
    if (!idToken) {
      return { success: false, error: "No ID found" }
    }

    let payload: JwtPayload
    try {
      const decoded = await verifyJwt(idToken, this.getSigningKey_, {
        algorithms: ["RS256"],
        audience: this.config_.clientId,
        issuer: GOOGLE_ISSUERS,
      })
      if (!decoded || typeof decoded === "string") {
        throw new Error("Invalid id_token")
      }
      payload = decoded
    } catch (err) {
      throw new MedusaError(
        MedusaError.Types.UNAUTHORIZED,
        `Could not verify Google id_token: ${err.message}`
      )
    }

    if (!payload.email_verified) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "Email not verified, cannot proceed with authentication"
      )
    }

    if (!payload.sub) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "id_token is missing 'sub' claim"
      )
    }

View on GitHub (pinned to 5e06e544a2)

Solutions

Ensure tokens come from the standard Google OAuth flow with the same client_id configured in the provider
Retry the flow — transient JWKS/network errors resolve themselves
Check the wrapped err.message to identify audience/expiry/signature mismatches and fix config accordingly

Defensive patterns

Strategy: retry

Try / catch

try { await provider.validateCallback(query) } catch (e) { if (e.type === 'unauthorized') { /* restart OAuth flow; possibly retry once for transient JWKS */ } else throw e }

Prevention

Always obtain id_tokens via the provider's own flow
Keep server clocks NTP-synced
Wrap auth callback handling to redirect to login on unauthorized errors

When it happens

Trigger: A malformed, tampered with, or expired id_token reaching verify_, or JWKS key lookup/audience/issuer checks failing during decoding.

Common situations: Client sending an id_token obtained for a different audience (client_id), clock skew causing expiry errors, transient JWKS fetch failures, or tokens from a different Google project.

Related errors

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/7a9809cd304a9087. Report an issue: GitHub.