Help with REQUEST_FAILED using Google OAuth

[epigramengineer]

Hi! Thanks so much for this project! As a caveat to this question I'm new to web development so I fully expect this to be my fault, but I'm not sure what to do.

I'm following the sveltekit lucia example template except using google instead of github. I've set up my credentials in google cloud, and have set my Authorized JavaScript origins to http://localhost:5178 and Authorized redirect URIs to http://localhost:5173/api/oauth/google. I've copied in my CLIENT_ID and CLIENT_SECRET parameter to a googleAuth value:

import { github, google } from '@lucia-auth/oauth/providers';
import { GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET } from '$env/static/private';

export const googleAuth = google(auth, {
  clientId: GOOGLE_CLIENT_ID,
  clientSecret: GOOGLE_CLIENT_SECRET,
  redirectUri: 'http://localhost:5173/api/oauth/google',
  scope: [
    'https://www.googleapis.com/auth/drive.readonly',
  ],
});

And I've got the following code in src/routes/api/oauth/google/+server.ts:

import { auth, googleAuth } from '$lib/server/lucia';
import { redirect, error } from '@sveltejs/kit';
import type { RequestHandler } from '../$types';

export const GET: RequestHandler = async ({ cookies, url, locals }) => {
  const code = url.searchParams.get('code');
  const state = url.searchParams.get('state');
  const storedState = cookies.get('oauth_state');
  if (storedState !== state || !code || !state) throw new Response(null, { status: 401 });
  try {
    console.log(`Hello world! ${code}`);
    const { existingUser, providerUser, createUser } = await googleAuth.validateCallback(code);
    console.log(providerUser);
    const user =
      existingUser ??
      (await createUser({
        username: providerUser.email
      }));
    const session = await auth.createSession(user.userId);
    locals.setSession(session);
  } catch (e) {
    console.log(e);
    console.log(await e.body);
    return new Response(null, {
      status: 500
    });
  }
  throw redirect(302, '/');
};

When I authenticate with google I get directed to the google UI, and the scopes show up correctly and it shows that it is my app from the cloud console making the request, I then accept and redirect back to my localhost, which goes to the correct route. In my logs I get to the Hello world! line, but the googleAuth.validateCallback(code) fails with the following:

LuciaOAuthRequestError: REQUEST_FAILED
    at handleRequest (file:///home/dev/project/web/node_modules/@lucia-auth/oauth/request.js:16:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.getProviderUser (file:///home/dev/project/web/node_modules/@lucia-auth/oauth/providers/google.js:37:28)
    at async Object.validateCallback (file:///home/dev/project/web/node_modules/@lucia-auth/oauth/core.js:11:52)
    at async GET (/home/dev/project/web/src/routes/api/oauth/google/+server.ts:15:56)
    at async Module.render_endpoint (/node_modules/@sveltejs/kit/src/runtime/server/endpoint.js:47:20)
    at async resolve (/node_modules/@sveltejs/kit/src/runtime/server/respond.js:375:17)
    at async Object.eval [as handle] (/node_modules/@lucia-auth/sveltekit/server/hooks.js:62:16)
    at async Module.respond (/node_modules/@sveltejs/kit/src/runtime/server/respond.js:248:20)
    at async file:///home/dev/project/web/node_modules/@sveltejs/kit/src/exports/vite/dev/index.js:505:22 {
  status: 401,
  body: Promise { <pending> }
}
{ error: 'invalid_request', error_description: 'Invalid Credentials' }

I've added my user to the test users in google cloud console as well, cleared the postgres database, and re-ran the prisma migration. I've tried in incognito window and multiple users, and I'm at a bit of a loss for what I can do to solve this. I see that the request coming back from google has the scope, state, and code set, and the oauth_state cookie is filled in.

Thanks for any help you're able to provide :)

[epigramengineer]

From some more reading it looks like Google might require an API key in the auth request? I don't see where I can provide one to lucia, but I would also imagine I'm not the first person to use the Google OAuth provider and I must be doing something else wrong.

[pilcrowonpaper]

Hm, can you try adding https://www.googleapis.com/auth/userinfo.profile to the scope? Might need to fix that if that's the solution

[epigramengineer]

Yup that fixed it!

[pilcrowonpaper]

Will update the package, thanks!