{"record":{"id":"741bbf0b470264c7","repo":"BoundaryML/baml","slug":"failed-to-load-gcp-creds-project-id-failed-to-resolve-try","errorCode":null,"errorMessage":"Failed to load GCP creds project ID (failed to resolve): try running `gcloud auth application-default login`","messagePattern":"Failed to load GCP creds project ID \\(failed to resolve\\): try running `gcloud auth application-default login`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/baml-runtime/src/internal/llm_client/primitive/vertex/wasm_auth.rs","lineNumber":86,"sourceCode":"            None => {\n                let cred_provider = get_js_callback_provider()?;\n                let gcp_creds = cred_provider.gcp_req().await.context(\n                    \"Failed to load GCP creds token: try running `gcloud auth application-default login`\",\n                )?;\n                Ok(Arc::new(Token(gcp_creds.access_token)))\n            }\n        }\n    }\n\n    pub async fn project_id(&self) -> Result<Arc<str>> {\n        match &self.0 {\n            Some(service_account) => Ok(service_account.project_id.clone().into()),\n            None => {\n                let cred_provider = get_js_callback_provider()?;\n                let gcp_creds = cred_provider.gcp_req().await.context(\n                    \"Failed to load GCP creds project ID (load failed): try running `gcloud auth application-default login`\",\n                )?;\n                Ok(gcp_creds.project_id.ok_or(anyhow::anyhow!(\n                    \"Failed to load GCP creds project ID (failed to resolve): try running `gcloud auth application-default login`\",\n                ))?.into())\n            }\n        }\n    }\n}\n\nfn parse_token_response(response: &str) -> Result<Token> {\n    let res: serde_json::Value =\n        serde_json::from_str(response).context(\"Failed to parse token response as JSON\")?;\n\n    Ok(Token(\n        res.as_object()\n            .context(\"Token exchange did not return a JSON object\")?\n            .get(\"access_token\")\n            .context(\"Access token not found in response\")?\n            .as_str()\n            .context(\"Access token is not a string\")?","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/engine/baml-runtime/src/internal/llm_client/primitive/vertex/wasm_auth.rs#L68-L104","documentation":"In the Vertex AI WASM runtime, BAML resolves the GCP project ID either from a service account or from ambient Application Default Credentials fetched via a JS callback provider. When ADC credentials load but their payload contains no `project_id` field, this error is thrown, advising the developer to establish credentials via the gcloud CLI.","triggerScenarios":"Calling a Vertex-ai backed BAML client (project_id resolution) when `cred_provider.gcp_req()` succeeds but returns credentials whose `project_id` is null/absent — typically because ADC metadata exists but is incomplete.","commonSituations":"Running in an environment where a stale or partial ADC quota project file exists (e.g. `~/.config/gcloud/application_default_credentials.json` lacks project info), CI images with half-configured auth, or Cloud Shell/Workload Identity setups where the project binding was never set.","solutions":["Run `gcloud auth application-default login` (and `gcloud auth application-default set-quota-project <PROJECT>`) to regenerate complete ADC credentials.","Set `GOOGLE_CLOUD_PROJECT` / configure the client with an explicit `project_id` in the BAML client config so ADC project resolution is not required.","Provide a proper service account in the client config so the `Some(service_account)` branch is used instead of ADC.","Verify ADC file contents contain a `quota_project_id`/project field and remove stale ones before re-authenticating."],"exampleFix":"// before (incomplete ADC, no project)\n$ gcloud config set project my-project   // only CLI project set\n\n// after\n$ gcloud auth application-default login\n$ gcloud auth application-default set-quota-project my-project\n\n// or pin it in BAML\n// before\nclient<GcpVertex> MyVertex { provider google-vertex ... }\n// after\nclient<GcpVertex> MyVertex { provider google-vertex options { project_id \"my-project\" ... } }","handlingStrategy":"validation","validationCode":"// Check ADC completeness before running the client\nconst adc = process.env.GOOGLE_APPLICATION_CREDENTIALS || '~/.config/gcloud/application_default_credentials.json';\nconst creds = JSON.parse(require('fs').readFileSync(adc.replace('~', require('os').homedir()), 'utf8'));\nif (!creds.project_id && !process.env.GOOGLE_CLOUD_PROJECT) {\n  throw new Error('ADC has no project_id; run `gcloud auth application-default set-quota-project <PROJECT>`');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run `gcloud auth application-default login` + `set-quota-project` in every dev/CI environment bootstrap","Prefer explicit service-account config with project_id in BAML client options","Set GOOGLE_CLOUD_PROJECT in the environment as a fallback"],"tags":["gcp","authentication","vertex-ai","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}