{"record":{"id":"8b517638ee211c95","repo":"grpc/grpc-go","slug":"credentials-failed-to-create-id-token-credentials","errorCode":null,"errorMessage":"credentials: failed to create ID token credentials: %v","messagePattern":"credentials: failed to create ID token credentials: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/google/gcp_service_account_identity_credentials.go","lineNumber":108,"sourceCode":"// but rather a context that is valid for the entire lifetime of the\n// credentials and should cancel the context when they are done.\n//\n// # Experimental\n//\n// Notice: This API is EXPERIMENTAL and may be changed or removed in a\n// later release.\nfunc NewServiceAccountIdentityCredentials(ctx context.Context, audience string) (credentials.PerRPCCredentials, error) {\n\tif ctx == nil {\n\t\treturn nil, fmt.Errorf(\"credentials: ctx cannot be nil\")\n\t}\n\n\tif audience == \"\" {\n\t\treturn nil, fmt.Errorf(\"credentials: audience cannot be empty\")\n\t}\n\n\tcreds, err := internal.NewIDTokenCredentials(&idtoken.Options{Audience: audience})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"credentials: failed to create ID token credentials: %v\", err)\n\t}\n\n\treturn &gcpServiceAccountIdentityCallCreds{\n\t\tctx:      ctx,\n\t\taudience: audience,\n\t\tcreds:    creds,\n\t\tbackoff:  internal.BackoffStrategy,\n\t}, nil\n}\n\n// GetRequestMetadata gets the current request metadata, refreshing tokens if\n// required. This implementation follows the PerRPCCredentials interface.\n//\n// It guarantees that only one underlying token fetch will be executed\n// concurrently. If a valid token is cached, it is returned immediately. If\n// a fetch recently failed, the cached error is returned until the backoff\n// interval expires. Otherwise, it initiates a new token fetch or blocks\n// waiting for an already-in-progress fetch to complete.","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/credentials/google/gcp_service_account_identity_credentials.go#L90-L126","documentation":"NewServiceAccountIdentityCredentials delegates to internal.NewIDTokenCredentials (idtoken.NewCredentials) and wraps any failure with this message (gcp_service_account_identity_credentials.go:106-109). The underlying %v is the idtoken library's error: the environment cannot source an ID token for the requested audience.","triggerScenarios":"idtoken.NewCredentials fails because the host is not on GCP (no metadata server to mint an ID token for the default service account), the service account email cannot be resolved, credentials cannot be discovered via ADC, or the audience is malformed for the token type.","commonSituations":"Running this GCP-only credential on a developer laptop or non-GCP CI; a GCE VM whose service account lacks the iam.serviceAccounts.actAs permission; ADC pointing at a JSON key file that does not support ID tokens for the given audience; or an outdated cloud.google.com/go/auth/credentials/idtoken module.","solutions":["Run only on GCP (GCE/GKE/Cloud Run/etc.) where the metadata server can mint ID tokens for the VM service account.","Read the wrapped %v error to distinguish 'not on GCP' from 'service account unauthorized'.","Ensure the VM/Workload service account has the IAM roles/permissions needed to mint ID tokens.","If you must run off-GCP, use a JSON service-account key path with idtoken directly instead of this metadata-server-based credential."],"exampleFix":"// before: metadata-server-based creds used off GCP\ncreds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)\n\n// after: only call this on GCP; guard the environment\nif os.Getenv(\"KUBERNETES_SERVICE_HOST\") == \"\" && !metadata.OnGCE() {\n    log.Fatal(\"NewServiceAccountIdentityCredentials requires GCP\")\n}\ncreds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)","handlingStrategy":"try-catch","validationCode":"// Guard the environment before using this GCP-only credential.\nimport \"cloud.google.com/go/compute/metadata\"\n\nif !metadata.OnGCE() {\n    return nil, errors.New(\"NewServiceAccountIdentityCredentials must run on GCP\")\n}\ncreds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)","typeGuard":null,"tryCatchPattern":"creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)\nif err != nil {\n    // err wraps the idtoken.NewCredentials failure; surface verbatim.\n    return nil, fmt.Errorf(\"cannot construct ID token credentials: %w\", err)\n}","preventionTips":["Only call this on GCP (GCE/GKE/Cloud Run) where the metadata server mints ID tokens.","Confirm the VM service account has permissions to mint ID tokens for the audience.","Keep cloud.google.com/go/auth/credentials/idtoken up to date.","Inspect the wrapped error to distinguish environment vs authorization failures."],"tags":["grpc","credentials","gcp","idtoken","configuration"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}