{"record":{"id":"867c94b86ef9df07","repo":"googleapis/mcp-toolbox","slug":"failed-to-get-token-from-token-source-w","errorCode":null,"errorMessage":"failed to get token from token source: %w","messagePattern":"failed to get token from token source: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/util.go","lineNumber":154,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"unsupported dbType: %s. Use 'mysql' or 'postgres'\", dbType)\n\t}\n\n\tif username == \"\" {\n\t\treturn \"\", fmt.Errorf(\"username from ADC cannot be an empty string\")\n\t}\n\n\treturn username, nil\n}\n\nfunc GetIAMAccessToken(ctx context.Context) (string, error) {\n\tcreds, err := google.FindDefaultCredentials(ctx, \"https://www.googleapis.com/auth/cloud-platform\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to find default credentials (run 'gcloud auth application-default login'?): %w\", err)\n\t}\n\n\ttoken, err := creds.TokenSource.Token() // This gets an oauth2.Token\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get token from token source: %w\", err)\n\t}\n\n\tif !token.Valid() {\n\t\treturn \"\", fmt.Errorf(\"retrieved token is invalid or expired\")\n\t}\n\treturn token.AccessToken, nil\n}\n","sourceCodeStart":136,"sourceCodeEnd":162,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/util.go#L136-L162","documentation":"After locating default credentials, GetIAMAccessToken requests an OAuth2 token via creds.TokenSource.Token(). This error wraps any failure in that exchange — network problems reaching Google's OAuth endpoints, revoked or malformed credentials, or clock skew invalidating the grant. It means credentials were found but could not be exchanged for a valid token.","triggerScenarios":"Calling GetIAMAccessToken with credentials that exist but fail token exchange: revoked service account key, deleted user account, network/firewall blocking oauth2.googleapis.com, system clock far out of sync, or corrupted ADC key file.","commonSituations":"Corporate proxy/firewall blocking Google OAuth endpoints; a service account key that was deleted or disabled in Cloud Console after being downloaded; VM with significant clock drift; expired/invalid refresh token in gcloud ADC.","solutions":["Check network access to https://oauth2.googleapis.com (proxy/firewall/DNS)","Re-authenticate: 'gcloud auth application-default login' or download a fresh service account key","Sync system time (ntp/chrony) if the machine clock is skewed","Verify the service account is enabled and the key is not revoked in Cloud Console"],"exampleFix":"# before: stale/revoked credentials\n# after: re-authenticate and retry\ngcloud auth application-default login","handlingStrategy":"retry","validationCode":"// Pre-flight: verify the OAuth token endpoint is reachable\nconst res = await fetch(\"https://oauth2.googleapis.com/token\", { method: \"HEAD\" }).catch(() => null);\nif (!res) throw new Error(\"oauth2.googleapis.com unreachable: check proxy/firewall\");","typeGuard":null,"tryCatchPattern":"try {\n  const token = await getIAMAccessToken(ctx);\n} catch (err) {\n  if (String(err).includes(\"failed to get token from token source\")) {\n    await backoffRetry(() => getIAMAccessToken(ctx), { retries: 3 }); // transient network failures\n  }\n  throw err;\n}","preventionTips":["Allow-list oauth2.googleapis.com in proxies/firewalls","Keep system clocks synced (chrony/ntp) to avoid invalid grant errors","Rotate service account keys before revocation and re-download fresh keys","Confirm the service account is enabled in Cloud Console"],"tags":["google-cloud","oauth2","network","authentication"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}