GoogleContainerTools/skaffold · error

failed to get access token %v

Error message

failed to get access token %v

What it means

The gcp package's Token implementation shells out to `gcloud auth print-access-token --format=json` to obtain an OAuth2 token for the active gcloud user. If the gcloud command exits nonzero, the error is wrapped as 'failed to get access token'.

Source

Thrown at pkg/skaffold/gcp/auth.go:78

		}
	}
}

type token struct {
	Token string `json:"token"`
}

type tokenSource struct {
}

func (ts tokenSource) Token() (*oauth2.Token, error) {
	// the command return a json object containing token
	cmd := exec.Command("gcloud", "auth", "print-access-token", "--format=json")
	var body bytes.Buffer
	cmd.Stdout = &body
	err := util.RunCmd(context.TODO(), cmd)
	if err != nil {
		return nil, fmt.Errorf("failed to get access token %v", err)
	}
	var t token
	if err := json.Unmarshal(body.Bytes(), &t); err != nil {
		return nil, fmt.Errorf("failed to unmarshal gcloud command result into access token %v", err)
	}
	return &oauth2.Token{AccessToken: t.Token}, nil
}

func activeUserCredentialsOnce() (*google.Credentials, error) {
	credsOnce.Do(func() {
		c, err := activeUserCredentials()
		if err != nil {
			log.Entry(context.TODO()).Infof("unable to retrieve gcloud access token: %v", err)
			log.Entry(context.TODO()).Info("falling back to application default credentials")
			credsErr = fmt.Errorf("retrieving gcloud access token: %w", err)
			return
		}
		creds = c

View on GitHub (pinned to a1189de023)

Solutions

1. Run `gcloud auth login` (or `gcloud auth application-default login`) to establish credentials.
2. Verify gcloud is installed and on PATH: `which gcloud && gcloud auth list`.
3. Check the wrapped cause from util.RunCmd for the gcloud stderr message.
4. Set GOOGLE_APPLICATION_CREDENTIALS to a service-account key if gcloud user auth is unavailable in CI.

Example fix

// before
$ skaffold ... # failed to get access token: exit status 1 (no active account)
// after
$ gcloud auth login
$ gcloud config set account you@example.com

// Pre-flight: is gcloud installed and authenticated?
if _, err := exec.LookPath("gcloud"); err != nil {
    return fmt.Errorf("gcloud not found on PATH")
}
out, err := exec.Command("gcloud", "auth", "list", "--format=json", "--filter=status:ACTIVE").Output()
if err != nil || len(out) < 4 {
    return fmt.Errorf("no active gcloud account; run `gcloud auth login`")
}

tok, err := tokenSource.Token()
if err != nil && strings.Contains(err.Error(), "failed to get access token") {
    return fmt.Errorf("run `gcloud auth login` or set GOOGLE_APPLICATION_CREDENTIALS: %w", err)
}

When it happens

Trigger: Calling activeUserCredentials (via credential-resolution flows) when gcloud is not installed, the user is not logged in, gcloud cannot reach the token endpoint, or the command fails for any other reason.

Common situations: Fresh machine or CI container where `gcloud auth login` was never run; PATH missing gcloud; revoked credentials; corporate proxy blocking gcloud's network calls.

Related errors

• failed to get repository read access token for repo %v: %w
• failed to unmarshal gcloud command result into access token
• retrieving gcloud access token: %w
• error getting google authenticator
• failed to create repository manager client: %w

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/990d8497053f9337. Report an issue: GitHub.