apache/seatunnel · error · SeaTunnelException

Failed to initialize Google Service Account credentials

Error message

Failed to initialize Google Service Account credentials

What it means

initGoogleCredentials loads Google service account credentials (from JSON content or a key file path) and throws this SeaTunnelException on IOException. Failures include the key file not existing, being unreadable, or containing invalid JSON. It prevents the source from initializing with broken authentication.

Source

Thrown at seatunnel-connectors-v2/connector-firebase/src/main/java/org/apache/seatunnel/connectors/seatunnel/firebase/client/FirebaseHttpClient.java:298

        }
    }

    private GoogleCredentials initGoogleCredentials(ReadonlyConfig config) {
        try {
            if (config.getOptional(FirebaseSourceOptions.CREDENTIALS).isPresent()) {
                String base64Credentials = config.get(FirebaseSourceOptions.CREDENTIALS);
                byte[] decodedBytes = Base64.getDecoder().decode(base64Credentials);
                try (InputStream inputStream = new ByteArrayInputStream(decodedBytes)) {
                    return GoogleCredentials.fromStream(inputStream).createScoped(FIREBASE_SCOPES);
                }
            } else if (config.getOptional(FirebaseSourceOptions.SERVICE_ACCOUNT_PATH).isPresent()) {
                String path = config.get(FirebaseSourceOptions.SERVICE_ACCOUNT_PATH);
                try (InputStream inputStream = new FileInputStream(path)) {
                    return GoogleCredentials.fromStream(inputStream).createScoped(FIREBASE_SCOPES);
                }
            }
        } catch (IOException e) {
            throw new SeaTunnelException(
                    "Failed to initialize Google Service Account credentials", e);
        }
        return null;
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Verify service_account_path exists and is readable by the SeaTunnel process (ls -l, check mount).
2. Re-download the service account key JSON from Google Cloud Console and replace a corrupt file.
3. Embed the JSON via service_account_json option instead of a path if file mounting is problematic.
4. Confirm the file is a standard JSON service-account key, not a PKCS12 (.p12) file.

Example fix

// before
service_account_path = "/secrets/sa.json" // file not mounted in container
// after
# docker run -v /local/sa.json:/secrets/sa.json ...
service_account_path = "/secrets/sa.json"

String path = config.get(FirebaseSourceOptions.SERVICE_ACCOUNT_PATH);
File f = new File(path);
if (!f.isFile() || !f.canRead()) throw new IllegalStateException("unreadable service account file: " + path);

try { client = new FirebaseHttpClient(config); } catch (SeaTunnelException e) { if (e.getMessage().contains("credentials")) { fixCredentialSource(); } throw e; }

When it happens

Trigger: service_account_path points to a missing or unreadable file; the key JSON is malformed; an IO error occurs while reading the configured credential source.

Common situations: Wrong file path in containerized deployments (file not mounted into the pod); file permissions denying read; truncated or edited service-account JSON; using a path in a format (PKCS12) not supported by fromStream.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• Failed to list BigQuery databases (datasets)
• Failed to execute HTTP request to Firebase endpoint
• Failed to read error stream from Firebase HTTP connection
• Circular condition chain detected: '%s' already exists in th
• Condition for option '%s' has a null operator

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/b2872b1f3d3d153b. Report an issue: GitHub.