{"record":{"id":"5bc7e88c122be323","repo":"apache/beam","slug":"failed-to-get-application-default-credential","errorCode":null,"errorMessage":"Failed to get application default credential.","messagePattern":"Failed to get application default credential\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/google-cloud-platform/src/main/java/org/apache/beam/sdk/io/gcp/testing/BigqueryClient.java","lineNumber":144,"sourceCode":"\n  // The initial backoff for executing a BigQuery RPC\n  private static final Duration INITIAL_BACKOFF = Duration.standardSeconds(1L);\n\n  // The backoff factory with initial configs\n  static final FluentBackoff BACKOFF_FACTORY =\n      FluentBackoff.DEFAULT.withMaxRetries(MAX_QUERY_RETRIES).withInitialBackoff(INITIAL_BACKOFF);\n\n  private static final Collection<String> RESERVED_FIELD_NAMES =\n      ClassInfo.of(TableRow.class).getNames();\n\n  private Bigquery bqClient;\n\n  private static Credentials getDefaultCredential() {\n    GoogleCredentials credential;\n    try {\n      credential = GoogleCredentials.getApplicationDefault();\n    } catch (IOException e) {\n      throw new RuntimeException(\"Failed to get application default credential.\", e);\n    }\n\n    if (credential.createScopedRequired()) {\n      Collection<String> bigqueryScope = Lists.newArrayList(BigqueryScopes.all());\n      credential = credential.createScoped(bigqueryScope);\n    }\n    return credential;\n  }\n\n  public static Bigquery getNewBigqueryClient(String applicationName) {\n    HttpTransport transport = Transport.getTransport();\n    JsonFactory jsonFactory = Transport.getJsonFactory();\n    Credentials credential = getDefaultCredential();\n    return new Bigquery.Builder(transport, jsonFactory, new HttpCredentialsAdapter(credential))\n        .setApplicationName(applicationName)\n        .build();\n  }\n","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/google-cloud-platform/src/main/java/org/apache/beam/sdk/io/gcp/testing/BigqueryClient.java#L126-L162","documentation":"BigqueryClient.getDefaultCredential obtains Google Application Default Credentials (ADC) for BigQuery test clients. If GoogleCredentials.getApplicationDefault() throws IOException, no ADC could be found in the environment, and a RuntimeException wrapping 'Failed to get application default credential.' is thrown.","triggerScenarios":"Calling credential()/getDefaultCredential() in an environment where GOOGLE_APPLICATION_CREDENTIALS is unset and no gcloud ADC metadata (~/.config/gcloud/application_default_credentials.json), GCE/GKE/App Engine default identity, or workload identity is available.","commonSituations":"Running BigQuery ITs locally without `gcloud auth application-default login`; CI containers without the credentials env var; mispointed GOOGLE_APPLICATION_CREDENTIALS path; service account key file deleted or unreadable.","solutions":["Run `gcloud auth application-default login` on the machine executing the tests.","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key path with BigQuery access.","Verify the file at GOOGLE_APPLICATION_CREDENTIALS exists and is readable (not a broken path).","In GCP environments (GCE/GKE/Cloud Run), attach the service account / workload identity with BigQuery scopes.","Grant the identity the `bigquery.jobs.create` / dataset roles needed."],"exampleFix":"// before (shell)\nmvn verify -Pit\n\n// after (shell)\ngcloud auth application-default login\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json\nmvn verify -Pit","handlingStrategy":"validation","validationCode":"// shell\nif [ -z \"$GOOGLE_APPLICATION_CREDENTIALS\" ] && ! gcloud auth application-default print-access-token >/dev/null 2>&1; then\n  echo \"No application default credentials found\"; exit 1\nfi","typeGuard":null,"tryCatchPattern":"try {\n  Credentials c = GoogleCredentials.getApplicationDefault();\n} catch (IOException e) {\n  throw new IllegalStateException(\"Set GOOGLE_APPLICATION_CREDENTIALS or run gcloud auth application-default login\", e);\n}","preventionTips":["Run gcloud auth application-default login before local IT runs.","Export GOOGLE_APPLICATION_CREDENTIALS in CI setup steps and fail fast if unset.","Verify key files exist and are readable at job startup.","Use workload identity in GCP environments instead of key files."],"tags":["java","gcp","bigquery","authentication","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}