apache/beam · critical · RuntimeException

Unable to get application default credentials. Please see ht

Error message

Unable to get application default credentials. Please see https://developers.google.com/accounts/docs/application-default-credentials for details on how to specify credentials. This version of the SDK is dependent on the gcloud core component version 2015.02.05 or newer to be able to get credentials from the currently authorized user via gcloud auth.

What it means

NullCredentialInitializer.throwNullCredentialException throws a RuntimeException when the Google Cloud client library could not obtain Application Default Credentials (credential is null). The message directs users to set up ADC, noting that gcloud core component 2015.02.05+ is needed for 'gcloud auth' based credentials.

Source

Thrown at sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/auth/NullCredentialInitializer.java:60

    httpRequest.setUnsuccessfulResponseHandler(new NullCredentialHttpUnsuccessfulResponseHandler());
  }

  private static class NullCredentialHttpUnsuccessfulResponseHandler
      implements HttpUnsuccessfulResponseHandler {

    @Override
    public boolean handleResponse(
        HttpRequest httpRequest, HttpResponse httpResponse, boolean supportsRetry)
        throws IOException {
      if (!httpResponse.isSuccessStatusCode() && httpResponse.getStatusCode() == ACCESS_DENIED) {
        throwNullCredentialException();
      }
      return supportsRetry;
    }
  }

  public static void throwNullCredentialException() {
    throw new RuntimeException(NULL_CREDENTIAL_REASON);
  }
}

View on GitHub (pinned to 12126d8942)

Solutions

Run `gcloud auth application-default login` on the local machine
Set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON key file path
Pass credentials explicitly via pipeline options (e.g. --serviceAccount or a Credentials provider)
Update the gcloud SDK to at least the required component version
Verify the code runs on an environment with a metadata server (GCE/GKE/Cloud Run) if relying on ambient credentials

Example fix

// before
$ mvn exec:java ... # no credentials configured -> RuntimeException
// after
$ gcloud auth application-default login
$ export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json

Defensive patterns

Strategy: try-catch

Validate before calling

try { GoogleCredentials.getApplicationDefault(); } catch (IOException e) { throw new IllegalStateException("ADC not configured: run gcloud auth application-default login or set GOOGLE_APPLICATION_CREDENTIALS"); }

Type guard

boolean adcAvailable() { try { GoogleCredentials.getApplicationDefault(); return true; } catch (IOException e) { return false; } }

Try / catch

try { runPipeline(options); } catch (RuntimeException e) { if (e.getMessage() != null && e.getMessage().contains("Unable to get application default credentials")) { /* prompt ADC setup */ } else throw e; }

Prevention

Set GOOGLE_APPLICATION_CREDENTIALS in CI/local environments
Run gcloud auth application-default login before local runs
Use a service account key or explicit credentials provider in options
Keep gcloud components up to date

When it happens

Trigger: Calling Google Cloud APIs via Beam (GCS, BigQuery, Dataflow) when no credential can be resolved: GOOGLE_APPLICATION_CREDENTIALS unset, no gcloud auth application-default login done, and no metadata-server credentials available (e.g. running locally outside GCP).

Common situations: Running a Beam pipeline locally without authenticating; CI containers lacking service-account keys; stale gcloud installations predating the required version.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/f4a8383ccbbf8d33. Report an issue: GitHub.