medusajs/medusa · critical · Error

Google clientSecret is required

Error message

Google clientSecret is required

What it means

The Google auth provider requires the OAuth client secret to exchange authorization codes for tokens. `validateOptions` throws at startup when `clientSecret` is missing.

Source

Thrown at packages/modules/providers/auth-google/src/services/google.ts:46

const GOOGLE_JWKS_URI = "https://www.googleapis.com/oauth2/v3/certs"
const GOOGLE_ISSUERS = ["https://accounts.google.com", "accounts.google.com"]

interface LocalServiceConfig extends GoogleAuthProviderOptions {}
export class GoogleAuthService extends AbstractAuthModuleProvider {
  static identifier = "google"
  static DISPLAY_NAME = "Google Authentication"

  protected config_: LocalServiceConfig
  protected logger_: Logger
  protected jwks_: JwksClient

  static validateOptions(options: GoogleAuthProviderOptions) {
    if (!options.clientId) {
      throw new Error("Google clientId is required")
    }

    if (!options.clientSecret) {
      throw new Error("Google clientSecret is required")
    }

    if (!options.callbackUrl) {
      throw new Error("Google callbackUrl is required")
    }
  }

  constructor(
    { logger }: InjectedDependencies,
    options: GoogleAuthProviderOptions
  ) {
    // @ts-ignore
    super(...arguments)
    this.config_ = options
    this.logger_ = logger
    this.jwks_ = jwksClient({
      jwksUri: GOOGLE_JWKS_URI,
      cache: true,

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Set clientSecret in provider options from GOOGLE_CLIENT_SECRET
2. Verify the value matches the current client secret shown in Google Cloud Console (regenerate if lost)

Example fix

// before
options: { clientId: process.env.GOOGLE_CLIENT_ID, callbackUrl }
// after
options: { clientId: process.env.GOOGLE_CLIENT_ID, clientSecret: process.env.GOOGLE_CLIENT_SECRET, callbackUrl }

for (const k of ['GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET', 'MEDUSA_BACKEND_URL']) {
  if (!process.env[k]) throw new Error(`Missing env var: ${k}`)
}

When it happens

Trigger: Configuring auth-google with clientId but no clientSecret, or GOOGLE_CLIENT_SECRET unset in the environment.

Common situations: Copying only the client id from Google Cloud Console, secret rotated/invalidated, or env var missing in production while present locally.

Related errors

• Google clientId is required
• Github clientId is required
• Github clientSecret is required
• Google callbackUrl is required
• OIDC engine requires an 'issuer' option

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/28b9411906a4909b. Report an issue: GitHub.