BoundaryML/baml · error

Failed to load GCP creds project ID (failed to resolve): try

Error message

Failed to load GCP creds project ID (failed to resolve): try running `gcloud auth application-default login`

What it means

In the Vertex AI WASM runtime, BAML resolves the GCP project ID either from a service account or from ambient Application Default Credentials fetched via a JS callback provider. When ADC credentials load but their payload contains no `project_id` field, this error is thrown, advising the developer to establish credentials via the gcloud CLI.

Source

Thrown at engine/baml-runtime/src/internal/llm_client/primitive/vertex/wasm_auth.rs:86

            None => {
                let cred_provider = get_js_callback_provider()?;
                let gcp_creds = cred_provider.gcp_req().await.context(
                    "Failed to load GCP creds token: try running `gcloud auth application-default login`",
                )?;
                Ok(Arc::new(Token(gcp_creds.access_token)))
            }
        }
    }

    pub async fn project_id(&self) -> Result<Arc<str>> {
        match &self.0 {
            Some(service_account) => Ok(service_account.project_id.clone().into()),
            None => {
                let cred_provider = get_js_callback_provider()?;
                let gcp_creds = cred_provider.gcp_req().await.context(
                    "Failed to load GCP creds project ID (load failed): try running `gcloud auth application-default login`",
                )?;
                Ok(gcp_creds.project_id.ok_or(anyhow::anyhow!(
                    "Failed to load GCP creds project ID (failed to resolve): try running `gcloud auth application-default login`",
                ))?.into())
            }
        }
    }
}

fn parse_token_response(response: &str) -> Result<Token> {
    let res: serde_json::Value =
        serde_json::from_str(response).context("Failed to parse token response as JSON")?;

    Ok(Token(
        res.as_object()
            .context("Token exchange did not return a JSON object")?
            .get("access_token")
            .context("Access token not found in response")?
            .as_str()
            .context("Access token is not a string")?

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Run `gcloud auth application-default login` (and `gcloud auth application-default set-quota-project <PROJECT>`) to regenerate complete ADC credentials.
2. Set `GOOGLE_CLOUD_PROJECT` / configure the client with an explicit `project_id` in the BAML client config so ADC project resolution is not required.
3. Provide a proper service account in the client config so the `Some(service_account)` branch is used instead of ADC.
4. Verify ADC file contents contain a `quota_project_id`/project field and remove stale ones before re-authenticating.

Example fix

// before (incomplete ADC, no project)
$ gcloud config set project my-project   // only CLI project set

// after
$ gcloud auth application-default login
$ gcloud auth application-default set-quota-project my-project

// or pin it in BAML
// before
client<GcpVertex> MyVertex { provider google-vertex ... }
// after
client<GcpVertex> MyVertex { provider google-vertex options { project_id "my-project" ... } }

// Check ADC completeness before running the client
const adc = process.env.GOOGLE_APPLICATION_CREDENTIALS || '~/.config/gcloud/application_default_credentials.json';
const creds = JSON.parse(require('fs').readFileSync(adc.replace('~', require('os').homedir()), 'utf8'));
if (!creds.project_id && !process.env.GOOGLE_CLOUD_PROJECT) {
  throw new Error('ADC has no project_id; run `gcloud auth application-default set-quota-project <PROJECT>`');
}

When it happens

Trigger: Calling a Vertex-ai backed BAML client (project_id resolution) when `cred_provider.gcp_req()` succeeds but returns credentials whose `project_id` is null/absent — typically because ADC metadata exists but is incomplete.

Common situations: Running in an environment where a stale or partial ADC quota project file exists (e.g. `~/.config/gcloud/application_default_credentials.json` lacks project info), CI images with half-configured auth, or Cloud Shell/Workload Identity setups where the project binding was never set.

Related errors

• Failed to auth - system_default strategy did not resolve suc
• options.project_id is required when using API key auth with
• Failed to resolve {}
• {e:?}
• JS callback error: {name}: {message}

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/741bbf0b470264c7. Report an issue: GitHub.