{"record":{"id":"5d82bb381076aa79","repo":"googleapis/mcp-toolbox","slug":"error-creating-client-from-adc-w","errorCode":null,"errorMessage":"error creating client from ADC: %w","messagePattern":"error creating client from ADC: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":198,"sourceCode":"\tvar restService *bigqueryrestapi.Service\n\tvar tokenSource oauth2.TokenSource\n\tvar clientCreator BigqueryClientCreator\n\tvar err error\n\n\ts := &Source{\n\t\tConfig:              r,\n\t\tClient:              client,\n\t\tRestService:         restService,\n\t\tTokenSource:         tokenSource,\n\t\tClientCreator:       clientCreator,\n\t\tAuthTokenHeaderName: \"Authorization\",\n\t}\n\n\tif strings.ToLower(r.UseClientOAuth) == \"false\" || r.UseClientOAuth == \"\" {\n\t\t// Initializes a BigQuery Google SQL source\n\t\tclient, restService, tokenSource, err = initBigQueryConnection(ctx, tracer, r.Name, r.Project, r.Location, r.QuotaProject, r.ImpersonateServiceAccount, r.Scopes, endpoint)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error creating client from ADC: %w\", err)\n\t\t}\n\t\ts.Client = client\n\t\ts.RestService = restService\n\t\ts.TokenSource = tokenSource\n\n\t\tif r.WriteMode == WriteModeProtected {\n\t\t\t// session-based connections\n\t\t\ts.SessionProvider = s.newBigQuerySessionProvider()\n\t\t}\n\t} else {\n\t\tif strings.ToLower(r.UseClientOAuth) != \"true\" {\n\t\t\ts.AuthTokenHeaderName = r.UseClientOAuth\n\t\t}\n\t\t// use client OAuth\n\t\tbaseClientCreator, err := newBigQueryClientCreator(ctx, tracer, r.Project, r.Location, r.QuotaProject, r.Name, endpoint)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error constructing client creator: %w\", err)\n\t\t}","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L180-L216","documentation":"When useClientOAuth is disabled (\"false\" or empty), Initialize builds a server-side client via Application Default Credentials (initBigQueryConnection). Any failure in that path — credential discovery, token source creation, quota project, impersonation, or client construction — is wrapped in this error.","triggerScenarios":"Initializing the BigQuery source without client OAuth when ADC cannot produce valid credentials: no GOOGLE_APPLICATION_CREDENTIALS, no gcloud user creds, metadata server unreachable, invalid impersonation target, or bad scopes/project/location.","commonSituations":"Running the toolbox in a local/dev environment without gcloud auth application-default login; container images missing the service account key file; GOOGLE_APPLICATION_CREDENTIALS pointing to a deleted or malformed JSON file.","solutions":["Run `gcloud auth application-default login` locally, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key.","Verify the impersonateServiceAccount email exists and the base identity has roles/iam.serviceAccountTokenCreator on it.","Check that project ID, location, and quotaProject values are valid and the account has BigQuery access."],"exampleFix":"// before (shell, no credentials)\n./toolbox\n// after\ngcloud auth application-default login\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json\n./toolbox","handlingStrategy":"try-catch","validationCode":"creds, err := google.FindDefaultCredentials(ctx, bigqueryapi.Scope)\nif err != nil {\n\treturn fmt.Errorf(\"ADC unavailable, run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"src, err := sourceRegistry.Initialize(ctx, cfg)\nif err != nil {\n\tvar adcErr interface{ Unwrap() error }\n\tif strings.Contains(err.Error(), \"error creating client from ADC\") {\n\t\tlog.Fatalf(\"ADC setup failed; check GOOGLE_APPLICATION_CREDENTIALS / gcloud auth: %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Always run `gcloud auth application-default login` on dev machines before starting the toolbox.","Mount service-account keys in containers and set GOOGLE_APPLICATION_CREDENTIALS.","Verify ADC with `gcloud auth application-default print-access-token` before startup.","Check Workload Identity/metadata server availability in GKE/Cloud Run."],"tags":["auth","adc","gcp","bigquery","credentials"],"backgroundTag":"adc-credentials-not-found","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}