diff --git a/backend/app/auth.py b/backend/app/auth.py
index 69a468f..d6ceb5b 100644
--- a/backend/app/auth.py
+++ b/backend/app/auth.py
@@ -82,6 +82,7 @@ async def validate_token(credentials: HTTPAuthorizationCredentials = Security(se
     token = credentials.credentials
     key = get_signing_key(token)
     public_key = jwk.construct(key)
+    discovery = get_discovery()
     try:
         # Only pass `audience` to the decoder if configured. Some providers
         # (or local development setups) may not include the aud claim in a