diff --git a/internal/api/token_oidc.go b/internal/api/token_oidc.go
index a5722f367..c380856c3 100644
--- a/internal/api/token_oidc.go
+++ b/internal/api/token_oidc.go
@@ -90,7 +90,7 @@ func (p *IdTokenGrantParams) getProvider(ctx context.Context, config *conf.Globa
 		}
 
 		if !allowed {
-			return nil, nil, "", nil, badRequestError(fmt.Sprintf("Custom OIDC provider %q not allowed", p.Issuer))
+			return nil, nil, "", nil, badRequestError(fmt.Sprintf("Custom OIDC provider %q not allowed", p.Provider))
 		}
 	}