{"record":{"id":"2065fa2ed1460801","repo":"grpc/grpc-go","slug":"unable-to-transfer-oauthaccess-perrpccredentials","errorCode":null,"errorMessage":"unable to transfer oauthAccess PerRPCCredentials: %v","messagePattern":"unable to transfer oauthAccess PerRPCCredentials: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/oauth/oauth.go","lineNumber":133,"sourceCode":"\treturn true\n}\n\n// oauthAccess supplies PerRPCCredentials from a given token.\ntype oauthAccess struct {\n\ttoken oauth2.Token\n}\n\n// NewOauthAccess constructs the PerRPCCredentials using a given token.\n//\n// Deprecated: use oauth.TokenSource instead.\nfunc NewOauthAccess(token *oauth2.Token) credentials.PerRPCCredentials {\n\treturn oauthAccess{token: *token}\n}\n\nfunc (oa oauthAccess) GetRequestMetadata(ctx context.Context, _ ...string) (map[string]string, error) {\n\tri, _ := credentials.RequestInfoFromContext(ctx)\n\tif err := credentials.CheckSecurityLevel(ri.AuthInfo, credentials.PrivacyAndIntegrity); err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to transfer oauthAccess PerRPCCredentials: %v\", err)\n\t}\n\treturn map[string]string{\n\t\t\"authorization\": oa.token.Type() + \" \" + oa.token.AccessToken,\n\t}, nil\n}\n\nfunc (oa oauthAccess) RequireTransportSecurity() bool {\n\treturn true\n}\n\n// NewComputeEngine constructs the PerRPCCredentials that fetches access tokens from\n// Google Compute Engine (GCE)'s metadata server. It is only valid to use this\n// if your program is running on a GCE instance.\n// TODO(dsymonds): Deprecate and remove this.\nfunc NewComputeEngine() credentials.PerRPCCredentials {\n\treturn TokenSource{google.ComputeTokenSource(\"\")}\n}\n","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/credentials/oauth/oauth.go#L115-L151","documentation":"Thrown from oauthAccess.GetRequestMetadata (oauth.go:133) when the security-level check fails for credentials created by the deprecated oauth.NewOauthAccess(token). The supplied static OAuth token is a bearer secret, so gRPC will not attach it over an insecure channel. RequireTransportSecurity() returns true.","triggerScenarios":"Using oauth.NewOauthAccess(token) (deprecated) on a channel with insecure.NewCredentials() or no transport credentials.","commonSituations":"Legacy code that still calls the deprecated NewOauthAccess; examples that predate oauth.TokenSource; mixing a manually obtained oauth2.Token with a plaintext channel.","solutions":["Migrate from deprecated NewOauthAccess to oauth.TokenSource{TokenSource: oauth2.StaticTokenSource(token)}.","Always pair these credentials with TLS transport credentials.","If plaintext is required, remove the per-RPC credentials entirely."],"exampleFix":"// before\ncreds := oauth.NewOauthAccess(token)\nconn, _ := grpc.NewClient(addr,\n    grpc.WithTransportCredentials(insecure.NewCredentials()),\n    grpc.WithPerRPCCredentials(creds),\n)\n\n// after\ncreds := oauth.TokenSource{TokenSource: oauth2.StaticTokenSource(token)}\nconn, _ := grpc.NewClient(addr,\n    grpc.WithTransportCredentials(credentials.NewClientTLSFromCert(caPool, \"\")),\n    grpc.WithPerRPCCredentials(creds),\n)","handlingStrategy":"validation","validationCode":"// Migrate off deprecated NewOauthAccess and always use TLS.\ncreds := oauth.TokenSource{TokenSource: oauth2.StaticTokenSource(token)}\ntlsCreds := credentials.NewClientTLSFromCert(caPool, \"\")\nconn, err := grpc.NewClient(addr,\n    grpc.WithTransportCredentials(tlsCreds),\n    grpc.WithPerRPCCredentials(creds),\n)","typeGuard":null,"tryCatchPattern":"if st, ok := status.FromError(err); ok && st.Code() == codes.Unavailable {\n    if strings.Contains(st.Message(), \"oauthAccess PerRPCCredentials\") {\n        // channel insecure; reconfigure with TLS\n    }\n}","preventionTips":["Stop using deprecated oauth.NewOauthAccess; switch to oauth.TokenSource.","Never attach static OAuth tokens to insecure channels.","Static tokens rotate via the TokenSource; configure TLS at the same time."],"tags":["oauth","security","transport","call-credentials","deprecated","go"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}