{"record":{"id":"1e64f65ba777e033","repo":"google-gemini/gemini-cli","slug":"compute-adc-failed-adcmessage-login-with-goo","errorCode":null,"errorMessage":"COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallback skipped due to ${reason}. Run in an interactive terminal to use OAuth.)","messagePattern":"COMPUTE_ADC failed: (.+?)\\. \\(LOGIN_WITH_GOOGLE fallback skipped due to (.+?)\\. Run in an interactive terminal to use OAuth\\.\\)","errorType":"exception","errorClass":"FatalAuthenticationError","httpStatus":null,"severity":"critical","filePath":"packages/a2a-server/src/config/config.ts","lineNumber":622,"sourceCode":"    try {\n      await config.refreshAuth(AuthType.COMPUTE_ADC);\n      logger.info(`[${logPrefix}] COMPUTE_ADC successful.`);\n    } catch (adcError) {\n      const adcMessage =\n        adcError instanceof Error ? adcError.message : String(adcError);\n      logger.info(\n        `[${logPrefix}] COMPUTE_ADC failed or not available: ${adcMessage}`,\n      );\n\n      const useComputeAdc =\n        getEnvLocal('GEMINI_CLI_USE_COMPUTE_ADC') === 'true';\n      const isHeadless = isHeadlessMode();\n\n      if (isHeadless || useComputeAdc) {\n        const reason = isHeadless\n          ? 'headless mode'\n          : 'GEMINI_CLI_USE_COMPUTE_ADC=true';\n        throw new FatalAuthenticationError(\n          `COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallback skipped due to ${reason}. Run in an interactive terminal to use OAuth.)`,\n        );\n      }\n\n      logger.info(\n        `[${logPrefix}] COMPUTE_ADC failed, falling back to LOGIN_WITH_GOOGLE.`,\n      );\n      try {\n        await config.refreshAuth(AuthType.LOGIN_WITH_GOOGLE);\n      } catch (e) {\n        if (e instanceof FatalAuthenticationError) {\n          const originalMessage = e instanceof Error ? e.message : String(e);\n          throw new FatalAuthenticationError(\n            `${originalMessage}. The initial COMPUTE_ADC attempt also failed: ${adcMessage}`,\n          );\n        }\n        throw e;\n      }","sourceCodeStart":604,"sourceCodeEnd":640,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/a2a-server/src/config/config.ts#L604-L640","documentation":"FatalAuthenticationError thrown by refreshAuthentication when USE_CCPA is set, the COMPUTE_ADC auth attempt failed, AND the LOGIN_WITH_GOOGLE OAuth fallback is intentionally skipped because either isHeadlessMode() is true or GEMINI_CLI_USE_COMPUTE_ADC=true was explicitly set. The message bundles the ADC failure reason and tells the user OAuth needs an interactive terminal.","triggerScenarios":"Running the server in a headless/CI/container environment with USE_CCPA set but no valid compute credentials (no metadata server, no service account), so COMPUTE_ADC fails and the headless guard suppresses the browser OAuth fallback. Also when GEMINI_CLI_USE_COMPUTE_ADC=true forces compute-only auth and ADC is unavailable.","commonSituations":"CI pipeline without GOOGLE_APPLICATION_CREDENTIALS; container lacking the Compute Engine metadata server; developer who set GEMINI_CLI_USE_COMPUTE_ADC=true on a workstation without a service account; expired service-account key.","solutions":["Provide valid compute credentials: set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON key, or run on a Compute Engine VM with the right scope.","For local/interactive use, unset GEMINI_CLI_USE_COMPUTE_ADC and run in a real terminal so the LOGIN_WITH_GOOGLE browser fallback can run.","Alternatively switch to GEMINI_API_KEY auth (unset USE_CCPA, set GEMINI_API_KEY).","Refresh the service-account key if it expired."],"exampleFix":"# before\nexport USE_CCPA=true\n# headless CI -> COMPUTE_ADC fails, OAuth skipped, FatalAuthenticationError\n\n# after (option A: service account)\nexport USE_CCPA=true\nexport GOOGLE_APPLICATION_CREDENTIALS=/secrets/sa-key.json\n\n# after (option B: API key)\nunset USE_CCPA\nexport GEMINI_API_KEY=...","handlingStrategy":"validation","validationCode":"function authReadyForHeadlessCcpa(env: NodeJS.ProcessEnv): boolean {\n  if (env['USE_CCPA'] !== 'true') return true; // not applicable\n  // In headless, compute ADC must work without OAuth fallback\n  return !!env['GOOGLE_APPLICATION_CREDENTIALS'] || hasGceMetadataServer();\n}","typeGuard":null,"tryCatchPattern":"try {\n  await refreshAuthentication(config, logPrefix, envVars);\n} catch (e) {\n  if (e instanceof FatalAuthenticationError && e.message.includes('COMPUTE_ADC failed')) {\n    // surface actionable guidance, fall back to API key\n    logger.error('CCPA ADC failed; set GEMINI_API_KEY as fallback.');\n  }\n  throw e;\n}","preventionTips":["In CI/containers, set GOOGLE_APPLICATION_CREDENTIALS to a service-account key.","Unset GEMINI_CLI_USE_COMPUTE_ADC in environments that should fall back to OAuth.","Run auth setup interactively once, then copy the cached credentials into the image.","Keep an API-key fallback (GEMINI_API_KEY) configured for headless deployments."],"tags":["authentication","gcp","compute-adc","headless","config"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}