BoundaryML/baml · critical

Failed to auth - system_default strategy did not resolve suc

Error message

Failed to auth - system_default strategy did not resolve successfully. Errors encountered: {:?}

What it means

This error is thrown when none of the auth strategies in the 'system_default' GCP auth strategy chain could resolve a valid credential for Vertex AI. All candidate strategies are attempted, their individual failures collected, and the aggregated errors are logged and returned. It means BAML could not authenticate to Google Cloud at all with the provided configuration.

Source

Thrown at engine/baml-runtime/src/internal/llm_client/primitive/vertex/std_auth.rs:158

                }
                match gcp_auth::GCloudAuthorizedUser::new().await {
                    Ok(authz_user) => {
                        log::debug!("Successful auth using GCloudAuthorizedUser strategy");
                        return Ok(VertexAuth::GCloudAuthorizedUser(authz_user));
                    }
                    Err(e) => {
                        errors.push(
                            anyhow::Error::from(e)
                                .context("Failed to auth using GCloudAuthorizedUser strategy"),
                        );
                    }
                }

                // Log all collected errors if no strategy succeeded
                for err in &errors {
                    log::error!("{err:?}");
                }
                anyhow::bail!(
                    "Failed to auth - system_default strategy did not resolve successfully. Errors encountered: {:?}",
                    errors
                )
            }
        }
    }

    async fn token_impl(&self, scopes: &[&str]) -> Result<Arc<Token>, Error> {
        match self {
            VertexAuth::CustomServiceAccount(authz_user) => authz_user.token(scopes).await,
            VertexAuth::ConfigDefaultCredentials(authz_user) => authz_user.token(scopes).await,
            VertexAuth::MetadataServiceAccount(authz_user) => authz_user.token(scopes).await,
            VertexAuth::GCloudAuthorizedUser(authz_user) => authz_user.token(scopes).await,
        }
    }

    async fn project_id_impl(&self) -> Result<Arc<str>, Error> {
        match self {

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Verify GCP credentials exist and are valid: set GOOGLE_APPLICATION_CREDENTIALS to a readable service-account JSON file, or run 'gcloud auth application-default login' locally
2. Check the detailed error list in the message (and the log::error output just before it) to see which strategy failed and why
3. If using an auth strategy in your BAML client config, confirm the referenced file path or JSON string resolves (env vars must be set at runtime, not just defined)
4. Confirm the service account has the Vertex AI User role and the project has the Vertex AI API enabled
5. Test credentials independently with 'gcloud auth print-access-token' or a direct curl to the Vertex endpoint

Example fix

// before (BAML client with unresolvable auth)
client<GcpVertex> MyVertex {
  provider vertex
  options {
    model gemini-1.5-pro
    credentials $MY_MISSING_ENV_VAR
  }
}
// after (export the env var or point to a real file)
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
export MY_MISSING_ENV_VAR=/path/to/service-account.json

fn ensure_gcp_credentials_ready() -> Result<(), String> {
    let has_adc = std::env::var_os("GOOGLE_APPLICATION_CREDENTIALS")
        .map(|p| std::path::Path::new(&p).is_file())
        .unwrap_or(false);
    let has_gcloud = std::process::Command::new("gcloud")
        .args(["auth", "application-default", "print-access-token"])
        .output()
        .map(|o| o.status.success())
        .unwrap_or(false);
    if has_adc || has_gcloud { Ok(()) } else {
        Err("No GCP credentials: set GOOGLE_APPLICATION_CREDENTIALS or run 'gcloud auth application-default login'".into())
    }
}

match ensure_gcp_credentials_ready() {
    Ok(()) => { /* call BAML vertex client */ }
    Err(e) => eprintln!("Skipping Vertex client: {e}"),
}

When it happens

Trigger: Using a Vertex AI client in BAML where every configured or default GCP auth strategy fails: missing/unreadable service-account JSON file, invalid JSON credentials, missing Application Default Credentials (no GOOGLE_APPLICATION_CREDENTIALS and no gcloud auth), or an unresolved environment-variable placeholder (e.g. a $VAR that is empty).

Common situations: Deploying to an environment without GCP credentials (CI, containers), pointing to a credentials file path that does not exist, typos in the service-account JSON, or forgetting to run 'gcloud auth application-default login' locally.

Related errors

• Failed to load GCP creds project ID (failed to resolve): try
• options.project_id is required when using API key auth with
• Failed to resolve {}
• {e:?}
• JS callback error: {name}: {message}

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/43fd207aa10996be. Report an issue: GitHub.