{"record":{"id":"3dd3102cefcbd98a","repo":"google-gemini/gemini-cli","slug":"originalmessage-the-initial-compute-adc-attemp","errorCode":null,"errorMessage":"${originalMessage}. The initial COMPUTE_ADC attempt also failed: ${adcMessage}","messagePattern":"(.+?)\\. The initial COMPUTE_ADC attempt also failed: (.+?)","errorType":"exception","errorClass":"FatalAuthenticationError","httpStatus":null,"severity":"critical","filePath":"packages/a2a-server/src/config/config.ts","lineNumber":635,"sourceCode":"\n      if (isHeadless || useComputeAdc) {\n        const reason = isHeadless\n          ? 'headless mode'\n          : 'GEMINI_CLI_USE_COMPUTE_ADC=true';\n        throw new FatalAuthenticationError(\n          `COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallback skipped due to ${reason}. Run in an interactive terminal to use OAuth.)`,\n        );\n      }\n\n      logger.info(\n        `[${logPrefix}] COMPUTE_ADC failed, falling back to LOGIN_WITH_GOOGLE.`,\n      );\n      try {\n        await config.refreshAuth(AuthType.LOGIN_WITH_GOOGLE);\n      } catch (e) {\n        if (e instanceof FatalAuthenticationError) {\n          const originalMessage = e instanceof Error ? e.message : String(e);\n          throw new FatalAuthenticationError(\n            `${originalMessage}. The initial COMPUTE_ADC attempt also failed: ${adcMessage}`,\n          );\n        }\n        throw e;\n      }\n    }\n\n    logger.info(\n      `[${logPrefix}] GOOGLE_CLOUD_PROJECT: ${getEnvLocal('GOOGLE_CLOUD_PROJECT')}`,\n    );\n  } else if (getEnvLocal('GEMINI_API_KEY')) {\n    logger.info(`[${logPrefix}] Using Gemini API Key`);\n    await config.refreshAuth(\n      AuthType.USE_GEMINI,\n      getEnvLocal('GEMINI_API_KEY'),\n    );\n  } else {\n    const errorMessage = `[${logPrefix}] Unable to set GeneratorConfig. Please provide a GEMINI_API_KEY or set USE_CCPA.`;","sourceCodeStart":617,"sourceCodeEnd":653,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/a2a-server/src/config/config.ts#L617-L653","documentation":"FatalAuthenticationError thrown when USE_CCPA is set, COMPUTE_ADC failed (triggering the LOGIN_WITH_GOOGLE fallback), and the OAuth fallback itself threw a FatalAuthenticationError. The handler concatenates the OAuth failure message with the original ADC failure message so both root causes are visible. Non-Fatal errors from the OAuth path are rethrown unchanged.","triggerScenarios":"Both auth paths fail: COMPUTE_ADC is unavailable AND the interactive LOGIN_WITH_GOOGLE flow hits a fatal error (e.g. browser open failed in a non-headless-but-broken environment, OAuth consent rejected, cached token corrupt). The catch at line 633 detects a FatalAuthenticationError and merges messages.","commonSituations":"Workstation with stale OAuth tokens where ADC also isn't provisioned; OAuth token cache corrupted; clock skew breaking token validation while ADC lacks a metadata server.","solutions":["Clear the cached OAuth credentials (gemini auth logout / remove the cached token file) and re-run login in an interactive terminal.","Address the COMPUTE_ADC failure per the embedded adcMessage (set GOOGLE_APPLICATION_CREDENTIALS or run on GCE).","Fall back to GEMINI_API_KEY auth if OAuth cannot be repaired.","Check the originalMessage portion for the specific OAuth fatal reason."],"exampleFix":"# before: both ADC and OAuth broken\nexport USE_CCPA=true\n\n# after: clear OAuth cache and use API key\nunset USE_CCPA\nexport GEMINI_API_KEY=...\n# (or) gemini auth login  # in an interactive terminal","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await refreshAuthentication(config, logPrefix, envVars);\n} catch (e) {\n  if (e instanceof FatalAuthenticationError) {\n    // both ADC and OAuth failed; switch strategy\n    envVars['GEMINI_API_KEY'] = process.env['GEMINI_API_KEY']!;\n    delete envVars['USE_CCPA'];\n    await refreshAuthentication(config, logPrefix, envVars);\n    return;\n  }\n  throw e;\n}","preventionTips":["Clear cached OAuth tokens (gemini auth logout / remove ~/.gemini/oauth_creds.json) before retrying.","Keep a GEMINI_API_KEY configured as a last-resort fallback.","Ensure service-account keys are rotated before expiry.","Run auth refresh in an interactive terminal during setup, then deploy the cached creds."],"tags":["authentication","gcp","compute-adc","oauth","fallback"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}