medusajs/medusa · error · MedusaError

id_token is missing 'sub' claim

Error message

id_token is missing 'sub' claim

What it means

The provider requires the id_token's standard `sub` (subject) claim to identify the Google user. If it is absent, verify_ throws INVALID_DATA because there is no stable entity id to create or match the auth identity against.

Source

Thrown at packages/modules/providers/auth-google/src/services/google.ts:207

        throw new Error("Invalid id_token")
      }
      payload = decoded
    } catch (err) {
      throw new MedusaError(
        MedusaError.Types.UNAUTHORIZED,
        `Could not verify Google id_token: ${err.message}`
      )
    }

    if (!payload.email_verified) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "Email not verified, cannot proceed with authentication"
      )
    }

    if (!payload.sub) {
      throw new MedusaError(
        MedusaError.Types.INVALID_DATA,
        "id_token is missing 'sub' claim"
      )
    }

    const entity_id = payload.sub
    const userMetadata = {
      name: payload.name,
      email: payload.email,
      picture: payload.picture,
      given_name: payload.given_name,
      family_name: payload.family_name,
    }

    let authIdentity

    try {
      authIdentity = await authIdentityService.retrieve({

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Ensure the id_token comes from a genuine Google OAuth flow (it will always carry sub)
2. In tests, mint tokens that include a sub claim
3. Discard any custom flow that passes arbitrary JWTs as id_token

try { await provider.validateCallback(query) } catch (e) { if (/missing 'sub'/.test(e.message)) res.redirect('/login?error=invalid_token') else throw e }

When it happens

Trigger: An id_token that verifies but lacks `sub`, typically from a non-standard token source or an unexpected token shape.

Common situations: Manually crafting tokens in tests, pointing the provider at a non-Google issuer, or Google emitting a token without sub in edge cases. Very rare in normal flows.

Related errors

• Could not verify Google id_token: ${err.message}
• Email not verified, cannot proceed with authentication
• Google clientId is required
• Google clientSecret is required
• Google callbackUrl is required

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/989bf8796c6be515. Report an issue: GitHub.