apache/iceberg · error · UncheckedIOException

Failed to get application default credentials

Error message

Failed to get application default credentials

What it means

BigQueryProperties.buildApplicationDefaultCredentials wraps the IOException thrown by GoogleCredentials.getApplicationDefault() in an UncheckedIOException when Application Default Credentials (ADC) cannot be resolved. ADC requires a well-known gcloud credentials file, GOOGLE_APPLICATION_CREDENTIALS pointing at a service-account key, or a metadata server (e.g. GCE/GKE). This library throws it because the BigQuery Metastore catalog cannot authenticate without credentials.

Source

Thrown at bigquery/src/main/java/org/apache/iceberg/gcp/bigquery/BigQueryProperties.java:173

    } else {
      builder.setCredentials(buildApplicationDefaultCredentials());
    }

    return builder.build();
  }

  private GoogleCredentials buildApplicationDefaultCredentials() {
    try {
      GoogleCredentials applicationDefaultCredentials =
          GoogleCredentials.getApplicationDefault().createScoped(BigqueryScopes.all());

      LOG.debug(
          "Created application default credentials for BigQuery: {}",
          applicationDefaultCredentials);

      return applicationDefaultCredentials;
    } catch (IOException e) {
      throw new UncheckedIOException("Failed to get application default credentials", e);
    }
  }

  private ImpersonatedCredentials buildImpersonatedCredentials() {
    try {
      GoogleCredentials sourceCredentials = GoogleCredentials.getApplicationDefault();

      ImpersonatedCredentials impersonatedCredentials =
          ImpersonatedCredentials.create(
              sourceCredentials, impersonateServiceAccount, delegates, scopes, lifetimeSeconds);

      // refresh to validate credentials and get initial token
      impersonatedCredentials.refresh();

      LOG.debug(
          "Created impersonated credentials for BigQuery: Target={}", impersonateServiceAccount);

      return impersonatedCredentials;

View on GitHub (pinned to 86d9c8fc54)

Solutions

1. Run `gcloud auth application-default login` on the local machine, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key path.
2. If running on GCP, ensure the workload runs on GCE/GKE/Cloud Run with a service account attached so the metadata server supplies credentials.
3. Verify the credentials file exists, is readable, and is valid JSON with the expected service-account fields.
4. Pass credentials explicitly via the BigQueryProperties/GCP configuration the catalog supports instead of relying on ADC.

Example fix

// before
BigMQCatalog.create(...); // no credentials configured
// after
$ gcloud auth application-default login
# or
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json

import com.google.auth.oauth2.GoogleCredentials;
boolean adcAvailable;
try {
  GoogleCredentials.getApplicationDefault().refreshIfExpired();
  adcAvailable = true;
} catch (IOException e) {
  adcAvailable = false;
}
if (!adcAvailable) throw new IllegalStateException("Set GOOGLE_APPLICATION_CREDENTIALS or run 'gcloud auth application-default login' before creating the BigQuery catalog");

try {
  catalog = BigQueryCatalog.create(...);
} catch (UncheckedIOException e) {
  throw new IllegalStateException("ADC unavailable: " + e.getCause().getMessage(), e);
}

When it happens

Trigger: Calling metastoreOptions (which builds the BigQuery client) on a machine with no ADC available: no gcloud user login, GOOGLE_APPLICATION_CREDENTIALS unset or pointing to a missing/invalid file, and no GCE metadata server.

Common situations: Running Spark/Flink jobs locally without `gcloud auth application-default login`; deploying outside GCP without mounting a service-account key; GOOGLE_APPLICATION_CREDENTIALS typo'd or the JSON key file deleted; running in non-GCP CI containers.

Related errors

• Creating BigQuery client failed due to a security issue
• Failed to create impersonated credentials for ${impersonateS
• Failed to load Google credentials
• Creating BigQuery client failed
• Table rename operation is unsupported.

AI-assisted analysis of apache/iceberg@86d9c8fc54 (2026-09-12). Data as JSON: /api/errors/59054d663c44977c. Report an issue: GitHub.