{"record":{"id":"336ffe0a79c8416f","repo":"google-gemini/gemini-cli","slug":"could-not-authenticate-using-metadata-server-appli","errorCode":null,"errorMessage":"Could not authenticate using metadata server application default credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ${getErrorMessage(e)}","messagePattern":"Could not authenticate using metadata server application default credentials\\. Please select a different authentication method or ensure you are in a properly configured environment\\. Error: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/code_assist/oauth2.ts","lineNumber":252,"sourceCode":"  // use Application Default Credentials (ADC) provided via its metadata server\n  // to authenticate non-interactively using the identity of the logged-in user.\n  if (authType === AuthType.COMPUTE_ADC) {\n    try {\n      debugLogger.log(\n        'Attempting to authenticate via metadata server application default credentials.',\n      );\n\n      const computeClient = new Compute({\n        // We can leave this empty, since the metadata server will provide\n        // the service account email.\n      });\n      await computeClient.getAccessToken();\n      debugLogger.log('Authentication successful.');\n\n      // Do not cache creds in this case; note that Compute client will handle its own refresh\n      return computeClient;\n    } catch (e) {\n      throw new Error(\n        `Could not authenticate using metadata server application default credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ${getErrorMessage(\n          e,\n        )}`,\n      );\n    }\n  }\n\n  if (config.isBrowserLaunchSuppressed()) {\n    if (!config.isInteractive()) {\n      throw new FatalAuthenticationError(\n        'Manual authorization is required but the current session is non-interactive. ' +\n          'Please run the Gemini CLI in an interactive terminal to log in, ' +\n          'provide a GEMINI_API_KEY, or ensure Application Default Credentials are configured.',\n      );\n    }\n    let success = false;\n    const maxRetries = 2;\n    // Enter alternate buffer","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/code_assist/oauth2.ts#L234-L270","documentation":"Thrown during OAuth2 authentication when AuthType.COMPUTE_ADC is selected but the Google Compute metadata server fails to return an access token. The code creates a Compute client from google-auth-library (which reads the GCE metadata server at 169.254.169.254) and calls getAccessToken(). If the metadata server is unreachable or returns an error, the raw error is wrapped into a descriptive message. This auth type only works inside GCE, Cloud Shell, Cloud Run, or GKE.","triggerScenarios":"AuthType.COMPUTE_ADC is resolved (e.g., because the environment looks like GCE or it was explicitly configured) but computeClient.getAccessToken() throws. The Compute client queries the metadata server at 169.254.169.254; failure means the server is unreachable, the instance has no service account, or a network firewall blocks the metadata endpoint.","commonSituations":"Running outside GCE but COMPUTE_ADC was forced via config; the GCE instance has no attached service account; a firewall rule or proxy blocks 169.254.169.254; running in a container that doesn't inherit the host's metadata network; Cloud Shell session expired or is in a degraded state; VPC-SC policies block the metadata request.","solutions":["Confirm you are actually running inside a GCE environment (GCE, Cloud Shell, Cloud Run, GKE).","Verify the instance has a service account attached with the required scopes.","If not in GCE, switch to LOGIN_WITH_GOOGLE or set GEMINI_API_KEY.","Check network/firewall rules allow access to 169.254.169.254.","If on Cloud Shell, restart the session or recreate the instance."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Detect GCE environment before attempting COMPUTE_ADC\nasync function isGCE(): Promise<boolean> {\n  try {\n    const res = await fetch('http://169.254.169.254/computeMetadata/v1/', {\n      headers: { 'Metadata-Flavor': 'Google' },\n      signal: AbortSignal.timeout(1000),\n    });\n    return res.headers.get('Metadata-Flavor') === 'Google';\n  } catch {\n    return false;\n  }\n}\n\nif (authType === AuthType.COMPUTE_ADC && !(await isGCE())) {\n  throw new Error('COMPUTE_ADC selected but not running on GCE.');\n}","typeGuard":null,"tryCatchPattern":"try {\n  client = await getOauthClient(AuthType.COMPUTE_ADC, config);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('metadata server application default credentials')) {\n    // Fall back to interactive OAuth or API key\n    client = await getOauthClient(AuthType.LOGIN_WITH_GOOGLE, config);\n  } else throw e;\n}","preventionTips":["Only select COMPUTE_ADC in known GCE environments.","Implement a metadata-server reachability check before choosing COMPUTE_ADC.","Provide a fallback auth method in configuration for when ADC fails.","Document that COMPUTE_ADC requires a service account with correct scopes."],"tags":["oauth","compute-adc","gce","metadata-server","environment","network"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}