{"record":{"id":"8527286f111319dd","repo":"googleapis/mcp-toolbox","slug":"failed-to-find-default-credentials-w-852728","errorCode":null,"errorMessage":"failed to find default credentials: %w","messagePattern":"failed to find default credentials: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudmonitoring/cloud_monitoring.go","lineNumber":77,"sourceCode":"}\n\n// Initialize initializes a Cloud Monitoring Source instance.\nfunc (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {\n\tua, err := util.UserAgentFromContext(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error in User Agent retrieval: %s\", err)\n\t}\n\n\tvar client *http.Client\n\tif r.UseClientOAuth {\n\t\tclient = &http.Client{\n\t\t\tTransport: util.NewUserAgentRoundTripper(ua, http.DefaultTransport),\n\t\t}\n\t} else {\n\t\t// Use Application Default Credentials\n\t\tcreds, err := google.FindDefaultCredentials(ctx, monitoring.MonitoringScope)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to find default credentials: %w\", err)\n\t\t}\n\t\tbaseClient := oauth2.NewClient(ctx, creds.TokenSource)\n\t\tbaseClient.Transport = util.NewUserAgentRoundTripper(ua, baseClient.Transport)\n\t\tclient = baseClient\n\t}\n\n\ts := &Source{\n\t\tConfig:    r,\n\t\tbaseURL:   \"https://monitoring.googleapis.com\",\n\t\tclient:    client,\n\t\tuserAgent: ua,\n\t}\n\treturn s, nil\n}\n\nvar _ sources.Source = &Source{}\n\ntype Source struct {","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudmonitoring/cloud_monitoring.go#L59-L95","documentation":"This error wraps google.FindDefaultCredentials failing to locate Application Default Credentials for the Cloud Monitoring scope. It occurs in Initialize when UseClientOAuth is false and the source must use ADC, but no credential chain can be found in the environment.","triggerScenarios":"Initializing a cloudmonitoring source with UseClientOAuth=false while no ADC source is available: GOOGLE_APPLICATION_CREDENTIALS unset/unreadable, no gcloud user credentials, no metadata server (e.g. running locally or in a non-GCP environment).","commonSituations":"Running the toolbox locally without 'gcloud auth application-default login'; missing service-account key file; key file path pointing to a nonexistent file; container without the metadata service.","solutions":["Run 'gcloud auth application-default login' for local development","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key","Enable UseClientOAuth and supply a client access token instead of server ADC","Verify Cloud Monitoring API access/permissions for the credential"],"exampleFix":"// before\ngoogle.FindDefaultCredentials(ctx, monitoring.MonitoringScope) // fails: no ADC\n// after\ngcloud auth application-default login\n// or:\ncreds, err := google.FindDefaultCredentials(ctx, monitoring.MonitoringScope)","handlingStrategy":"fallback","validationCode":"creds, err := google.FindDefaultCredentials(ctx, monitoring.MonitoringScope)\nif err != nil {\n    return fmt.Errorf(\"ADC unavailable before init: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"could not find default credentials\") {\n        log.Fatal(\"run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS\")\n    }\n    return err\n}","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS in deployment manifests","Run ADC login in dev onboarding docs","Health-check credentials at process startup","On GCP runtimes rely on the attached service account instead of key files"],"tags":["gcp","cloud-monitoring","authentication","adc","go"],"backgroundTag":"google-default-credentials-not-found","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}