vxcontrol/pentagi · error

email is empty in Google ID Token claims

Error message

email is empty in Google ID Token claims

What it means

Thrown when the verified Google ID Token contains no email claim (claims.Email == "") after nonce validation succeeded. PentAGI keys user identity on email, so a token without an email cannot create or match a user account. Google omits the email claim when the account has no primary email or the app did not request email scopes.

Source

Thrown at backend/pkg/server/oauth/google.go:54

		if idToken.Nonce != nonce {
			return "", false, fmt.Errorf("nonce mismatch in Google ID Token")
		}

		if err = idToken.VerifyAccessToken(token.AccessToken); err != nil {
			return "", false, fmt.Errorf("failed to verify Google Access Token: %w", err)
		}

		claims := googleTokenClaims{}
		if err := idToken.Claims(&claims); err != nil {
			return "", false, fmt.Errorf("failed to parse Google ID Token claims: %w", err)
		}

		if claims.Nonce != nonce {
			return "", false, fmt.Errorf("nonce mismatch in Google ID Token claims")
		}

		if claims.Email == "" {
			return "", false, fmt.Errorf("email is empty in Google ID Token claims")
		}

		return claims.Email, claims.EmailVerified, nil
	}
}

func NewGoogleOAuthClient(clientID, clientSecret, redirectURL string) OAuthClient {
	return NewOAuthClient("google", &oauth2.Config{
		ClientID:     clientID,
		ClientSecret: clientSecret,
		RedirectURL:  redirectURL,
		Scopes: []string{
			"https://www.googleapis.com/auth/userinfo.email",
			"openid",
		},
		Endpoint: google.Endpoint,
	}, newGoogleEmailResolver(clientID))
}

View on GitHub (pinned to ea665308ba)

Solutions

1. Confirm the client requests scopes "openid" and "https://www.googleapis.com/auth/userinfo.email" (see NewGoogleOAuthClient) — add them if missing.
2. Update the Google Cloud OAuth consent screen to include the email scope and re-publish.
3. Test with a personal Google account that has a primary email to rule out Workspace restrictions.
4. Have the affected user re-consent (revoke app access at myaccount.google.com/permissions and log in again).
5. If emails legitimately may be absent, fall back to the userinfo endpoint (GET userinfo.email profile) using the access token.

Example fix

// before
Scopes: []string{
    "https://www.googleapis.com/auth/userinfo.email",
    "openid",
},
// after (unchanged scopes, but add a fallback when email is absent)
if claims.Email == "" {
    return "", false, fmt.Errorf("email is empty in Google ID Token claims: re-consent with email scope required")
}

// check scopes before initiating the OAuth flow
required := []string{"openid", "https://www.googleapis.com/auth/userinfo.email"}
for _, r := range required {
    if !slices.Contains(cfg.Scopes, r) {
        return fmt.Errorf("missing required scope: %s", r)
    }
}

func hasEmailClaim(claims googleTokenClaims) bool {
    return claims.Email != "" && strings.Contains(claims.Email, "@")
}

email, verified, err := resolver.Resolve(ctx, nonce, token)
if err != nil {
    if strings.Contains(err.Error(), "email is empty") {
        return fmt.Errorf("Google account did not share an email; re-consent with the email scope")
    }
    return err
}

When it happens

Trigger: Google OAuth callback where the ID token passed verification and nonce checks but carries an empty email — the OAuth client lacks the userinfo.email / openid scopes, or the Google account has no email to disclose, or email scope consent was not granted.

Common situations: Workspace accounts where the admin disabled email sharing; apps whose Google Cloud OAuth consent screen doesn't include the email scope; users who declined the email permission during consent; using a service account or restricted test account without a primary email.

Related errors

• could not create Google OpenID client: %w
• id_token is not present in the token
• could not verify Google ID Token: %w
• nonce mismatch in Google ID Token
• failed to verify Google Access Token: %w

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/289bcac043a7a941. Report an issue: GitHub.