{"record":{"id":"89af8b89993f629f","repo":"google-gemini/gemini-cli","slug":"failed-to-get-adc-access-token-e-instanceof-err","errorCode":null,"errorMessage":"Failed to get ADC access token: ${e instanceof Error ? e.message : String(e)}","messagePattern":"Failed to get ADC access token: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/auth-provider/google-credentials-provider.ts","lineNumber":140,"sourceCode":"      const client = await this.auth.getClient();\n      const token = await client.getAccessToken();\n\n      if (token.token) {\n        this.cachedToken = token.token;\n        // Use expiry_date from the underlying credentials if available.\n        const creds = client.credentials;\n        if (creds.expiry_date) {\n          this.tokenExpiryTime = creds.expiry_date;\n        }\n        return { Authorization: `Bearer ${token.token}` };\n      }\n      throw new Error('Failed to retrieve ADC access token.');\n    } catch (e) {\n      const errorMessage = `Failed to get ADC access token: ${\n        e instanceof Error ? e.message : String(e)\n      }`;\n      debugLogger.error(errorMessage, e);\n      throw new Error(errorMessage);\n    }\n  }\n\n  override async shouldRetryWithHeaders(\n    _req: RequestInit,\n    res: Response,\n  ): Promise<HttpHeaders | undefined> {\n    if (res.status !== 401 && res.status !== 403) {\n      this.authRetryCount = 0;\n      return undefined;\n    }\n\n    if (this.authRetryCount >= BaseA2AAuthProvider.MAX_AUTH_RETRIES) {\n      return undefined;\n    }\n    this.authRetryCount++;\n\n    debugLogger.debug(","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/agents/auth-provider/google-credentials-provider.ts#L122-L158","documentation":"The outer catch on the access-token path: getClient or getAccessToken threw an Error, and it is wrapped as 'Failed to get ADC access token: <message>'. Unlike 195 (which fires when a token object exists but is empty), this fires when the call itself rejects. The underlying message usually names the precise failure (invalid_grant, no credentials found, network).","triggerScenarios":"No ADC configured at all (google-auth-library throws 'Could not load the default credentials'); a refresh-token grant failed with invalid_grant; the metadata server is unreachable from the runtime; the credential JSON is malformed.","commonSituations":"First run on a new machine/container without ADC; a long-lived key whose refresh expired; a sandboxed runtime that blocks the metadata server (169.254.169.254); corrupted credentials JSON.","solutions":["Set up ADC: `gcloud auth application-default login` (dev) or Workload Identity Federation (CI/prod).","Read the inner message to distinguish 'no credentials' from 'invalid_grant'.","For invalid_grant, re-login or rotate the service-account key.","Ensure the runtime can reach the GCE metadata server if running on GCE."],"exampleFix":"# before - no ADC\n$ node app.js   # 'Failed to get ADC access token: Could not load the default credentials.'\n\n# after\n$ gcloud auth application-default login\n$ node app.js","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  return await provider.headers();\n} catch (e) {\n  const msg = (e as Error).message;\n  if (/Could not load the default credentials/.test(msg)) {\n    throw new Error('ADC is not configured. Run `gcloud auth application-default login`.');\n  }\n  if (/invalid_grant/.test(msg)) {\n    throw new Error('ADC token expired or revoked. Re-login required.');\n  }\n  throw e;\n}","preventionTips":["Configure ADC in every environment (dev, CI, prod).","Rotate service-account keys before refresh tokens expire.","Ensure runtimes can reach the GCE metadata server."],"tags":["auth","google-credentials","adc","access-token","environment"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}