{"record":{"id":"181d29f7743da222","repo":"eyaltoledano/claude-task-master","slug":"authentication-failed-errormessage","errorCode":null,"errorMessage":"Authentication failed: ${errorMessage}","messagePattern":"Authentication failed: (.+?)","errorType":"exception","errorClass":"VertexAuthError","httpStatus":401,"severity":"error","filePath":"src/ai-providers/google-vertex.js","lineNumber":188,"sourceCode":"\t\tlog('error', `Vertex AI ${operation} error:`, error);\n\n\t\t// Handle known error types\n\t\tif (\n\t\t\terror.name === 'VertexAuthError' ||\n\t\t\terror.name === 'VertexConfigError' ||\n\t\t\terror.name === 'VertexApiError'\n\t\t) {\n\t\t\tthrow error;\n\t\t}\n\n\t\t// Handle network/API errors\n\t\tif (error.response) {\n\t\t\tconst statusCode = error.response.status;\n\t\t\tconst errorMessage = error.response.data?.error?.message || error.message;\n\n\t\t\t// Categorize by status code\n\t\t\tif (statusCode === 401 || statusCode === 403) {\n\t\t\t\tthrow new VertexAuthError(`Authentication failed: ${errorMessage}`);\n\t\t\t} else if (statusCode === 400) {\n\t\t\t\tthrow new VertexConfigError(`Invalid request: ${errorMessage}`);\n\t\t\t} else {\n\t\t\t\tthrow new VertexApiError(\n\t\t\t\t\t`API error (${statusCode}): ${errorMessage}`,\n\t\t\t\t\tstatusCode\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Generic error handling\n\t\tthrow new Error(`Vertex AI ${operation} failed: ${error.message}`);\n\t}\n}\n","sourceCodeStart":170,"sourceCodeEnd":203,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/src/ai-providers/google-vertex.js#L170-L203","documentation":"GoogleVertexProvider wraps HTTP errors from the Vertex AI REST endpoint in a VertexAuthError when the API responds with 401 or 403. This means the request reached Google but the credentials presented were rejected or lack permission. The original Google error message is preserved in the new error's message.","triggerScenarios":"getClient() calls the Vertex AI API and error.response.status is 401 or 403; handleError is invoked by the catch block around the request.","commonSituations":"Expired or missing Google Cloud auth token (e.g. not run 'gcloud auth application-default login'), GOOGLE_APPLICATION_CREDENTIALS pointing to a stale/revoked service-account key, service account lacking the 'Vertex AI User' (roles/aiplatform.user) IAM role, wrong project ID, or Vertex AI API not enabled for the project.","solutions":["Re-authenticate: run 'gcloud auth application-default login' or refresh the service-account key and set GOOGLE_APPLICATION_CREDENTIALS to it.","Verify the service account has roles/aiplatform.user on the project and that the Vertex AI API is enabled (gcloud services enable aiplatform.googleapis.com).","Confirm GOOGLE_VERTEX_PROJECT and GOOGLE_VERTEX_LOCATION match the project where credentials are valid.","Read the embedded errorMessage in the thrown VertexAuthError for Google's exact denial reason (e.g. 'API not enabled' vs 'Permission denied')."],"exampleFix":"// before: stale/absent credentials\n// vertex = new GoogleVertexProvider({ projectId: 'my-proj' }); // 401\n// after\n// gcloud auth application-default login\n// export GOOGLE_APPLICATION_CREDENTIALS=/path/to/fresh-key.json","handlingStrategy":"try-catch","validationCode":"import { execSync } from 'child_process';\nfunction hasGoogleCredentials() {\n  if (process.env.GOOGLE_APPLICATION_CREDENTIALS) {\n    return fs.existsSync(process.env.GOOGLE_APPLICATION_CREDENTIALS);\n  }\n  try { execSync('gcloud auth application-default print-access-token', { stdio: 'ignore' }); return true; }\n  catch { return false; }\n}\nif (!hasGoogleCredentials()) throw new Error('Set GOOGLE_APPLICATION_CREDENTIALS or run gcloud auth application-default login');","typeGuard":"function isVertexAuthError(e) {\n  return e instanceof Error && (e.name === 'VertexAuthError' || /Authentication failed:/.test(e.message));\n}","tryCatchPattern":"try {\n  await vertex.getClient(...);\n} catch (e) {\n  if (/Authentication failed:/.test(e.message)) {\n    // refresh gcloud credentials / service-account key, then retry once\n    execSync('gcloud auth application-default login');\n    return await vertex.getClient(...);\n  }\n  throw e;\n}","preventionTips":["Run gcloud auth application-default login and refresh tokens before long sessions","Verify GOOGLE_APPLICATION_CREDENTIALS points to an existing, unrevoked key file","Grant roles/aiplatform.user to the service account","Enable the Vertex AI API in your project"],"tags":["authentication","google-vertex","http-401","http-403"],"backgroundTag":"api-auth-rejected","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}