Auth0 "Custom Social" for Google fails with "Invalid user id."

I setup Auth0 and Google credentials and had it working using the free trial period within Auth0. this is for a side-project so I need to switch to the free tier "Custom Social" Auth0 logins. I followed these instructions but end up with the error "Invalid user id" in both the Auth0 test page and the app I had working with the Social Login that is pre-build by Auth0.

In GCP console I created a "Client ID for Web application"

Authorised JavaScript origins = https://MY_TENANT.uk.auth0.com
Authorised redirect URIs = https://MY_TENANT.uk.auth0.com/login/callback

GCP "OAuth consent screen"

Publishing status = Testing
User type = External

App Registration (just setting this to get it working)

Application home page = https://auth0.com
Application privacy policy link = https://auth0.com
Application Terms of Service link = https://auth0.com
Authorised domain = auth0.com
Your non-sensitive scopes = /auth/userinfo.email
Test users = my email address

It generates

GCP_CLIENT_ID = XXX.apps.googleusercontent.com
GCP_CLIENT_SECRET = YYY

Over in Auth0 I created a new Custom Socal Login

Authorization URL = https://accounts.google.com/o/oauth2/auth
Token URL = https://oauth2.googleapis.com/token
Scope = openid email (spaces set on)
Client ID = GCP_CLIENT_ID
Client Secret = GCP_CLIENT_SECRET
Fetch User Profile Script

function(accessToken, ctx, cb) {
  var p = {
    accessToken: accessToken,
    id_token: ctx.id_token
  };
  cb(null,p);
}

Pres test, Login screen displayed, select test account, then the error is displayed

Solution

The answer

I was badly parsing the response in the fetch javascript.

the user_id is required, but I'd got the parsing part in my real code wrong

How did I work it out?

I have a simple httpDump app written in go that I use for these kinds of things, it just dumps whatever gets sent to it and returns the time.

I used ngrok to forward my local httpDump to the internet and updated the fetch script to point to my laptop.

The http request worked, which was nice because to that point I had no idea where the error was.

I then manually called google with the token and it's response was

{
  "sub": "a number",
  "picture": "https://lh3.googleusercontent.com/a-/some_number",
  "email": "my.email@example.com",
  "email_verified": true
}

and not the structure I'd copied from the Auth0 article I'd found.