{"record":{"id":"8fde7d767876e637","repo":"googleapis/mcp-toolbox","slug":"failed-to-find-default-google-cloud-credentials-wi-8fde7d","errorCode":null,"errorMessage":"failed to find default Google Cloud credentials with scope %q: %w","messagePattern":"failed to find default Google Cloud credentials with scope %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudloggingadmin/cloud_logging_admin.go","lineNumber":393,"sourceCode":"\t\tcloudPlatformTokenSource, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{\n\t\t\tTargetPrincipal: impersonateServiceAccount,\n\t\t\tScopes:          []string{\"https://www.googleapis.com/auth/cloud-platform\"},\n\t\t})\n\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"failed to create impersonated credentials for %q: %w\", impersonateServiceAccount, err)\n\t\t}\n\n\t\ttokenSource = cloudPlatformTokenSource\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithTokenSource(cloudPlatformTokenSource),\n\t\t}\n\t} else {\n\t\t// Use default credentials\n\t\tcred, err := google.FindDefaultCredentials(ctx, logging.AdminScope)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"failed to find default Google Cloud credentials with scope %q: %w\", logging.AdminScope, err)\n\t\t}\n\t\ttokenSource = cred.TokenSource\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithCredentials(cred),\n\t\t}\n\t}\n\n\tclient, err := logadmin.NewClient(ctx, project, opts...)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to create Cloud Logging Admin client for project %q: %w\", project, err)\n\t}\n\treturn client, tokenSource, nil\n}\n\nfunc initLogAdminConnectionWithOAuthToken(\n\tctx context.Context,\n\ttracer trace.Tracer,","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudloggingadmin/cloud_logging_admin.go#L375-L411","documentation":"initLogAdminConnection, when no explicit service account key or client OAuth token is configured, falls back to Application Default Credentials via google.FindDefaultCredentials with the Cloud Logging Admin scope. This error means ADC could not locate any usable credentials on the host, wrapped with the requested scope (https://www.googleapis.com/auth/logging.admin).","triggerScenarios":"Initialize() for the cloudloggingadmin source runs on a machine with no GOOGLE_APPLICATION_CREDENTIALS env var, no gcloud user credentials (~/.config/gcloud/application_default_credentials.json), and no attached GCE/GKE/Cloud Run service account, and no explicit credentials in the toolbox YAML.","commonSituations":"Running the toolbox locally without ever running `gcloud auth application-default login`; a Docker container without the service-account key mounted; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing/deleted file; migrating code from a GCE VM to a laptop.","solutions":["Set GOOGLE_APPLICATION_CREDENTIALS to the path of a valid service-account JSON key that has the Cloud Logging Admin role","Or run `gcloud auth application-default login` locally to install user ADC credentials","If running in Docker/K8s, mount the key file or attach the workload's service account; verify metadata server access on GCE/Cloud Run","Verify GOOGLE_APPLICATION_CREDENTIALS actually points to an existing readable file (no typo) and the key has logging scope permissions","Alternatively configure explicit credentials in the source YAML instead of relying on ADC"],"exampleFix":"// before: no credentials anywhere\nexport PATH=$PATH:toolbox && ./toolbox --tools \"my-logging-tools\"\n// failed to find default Google Cloud credentials with scope \"https://www.googleapis.com/auth/logging.admin\"\n// after\ngcloud auth application-default login\nexport GOOGLE_APPLICATION_CREDENTIALS=$HOME/.config/gcloud/application_default_credentials.json\n./toolbox --tools \"my-logging-tools\"","handlingStrategy":"validation","validationCode":"// Node/Go-style preflight: confirm ADC resolves before starting the toolbox\nconst { GoogleAuth } = require('google-auth-library');\nasync function assertADC() {\n  try { const c = await new GoogleAuth({ scopes: ['https://www.googleapis.com/auth/logging.admin'] }).getClient(); return !!c; }\n  catch (e) { throw new Error('No Application Default Credentials: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS'); }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await source.initialize();\n} catch (e) {\n  if (/failed to find default Google Cloud credentials/.test(e.message)) {\n    // fall back to explicit service-account key configured in the YAML\n    await source.initializeWithKeyFile(keyFile);\n  } else { throw e; }\n}","preventionTips":["Run `gcloud auth application-default login` on developer machines before starting the toolbox","Set GOOGLE_APPLICATION_CREDENTIALS and verify the file exists and is readable in containers","When deploying on GKE/Cloud Run/GCE, attach a service account with the Logging Admin role and confirm metadata server reachability","Check the key file has not been rotated/deleted; verify with `gcloud auth application-default print-access-token`"],"tags":["authentication","google-cloud","adc","credentials","logging"],"backgroundTag":"missing-google-cloud-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}