{"record":{"id":"92149c2119c3d697","repo":"google-gemini/gemini-cli","slug":"failed-to-get-adc-id-token-e-instanceof-error","errorCode":null,"errorMessage":"Failed to get ADC ID token: ${e instanceof Error ? e.message : String(e)}","messagePattern":"Failed to get ADC ID token: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/auth-provider/google-credentials-provider.ts","lineNumber":116,"sourceCode":"      try {\n        const idClient = await this.auth.getIdTokenClient(this.audience!);\n        const idToken = await idClient.idTokenProvider.fetchIdToken(\n          this.audience!,\n        );\n\n        const expiryTime = OAuthUtils.parseTokenExpiry(idToken);\n        if (expiryTime) {\n          this.tokenExpiryTime = expiryTime;\n          this.cachedToken = idToken;\n        }\n\n        return { Authorization: `Bearer ${idToken}` };\n      } catch (e) {\n        const errorMessage = `Failed to get ADC ID token: ${\n          e instanceof Error ? e.message : String(e)\n        }`;\n        debugLogger.error(errorMessage, e);\n        throw new Error(errorMessage);\n      }\n    }\n\n    // Otherwise, access token\n    try {\n      const client = await this.auth.getClient();\n      const token = await client.getAccessToken();\n\n      if (token.token) {\n        this.cachedToken = token.token;\n        // Use expiry_date from the underlying credentials if available.\n        const creds = client.credentials;\n        if (creds.expiry_date) {\n          this.tokenExpiryTime = creds.expiry_date;\n        }\n        return { Authorization: `Bearer ${token.token}` };\n      }\n      throw new Error('Failed to retrieve ADC access token.');","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/core/src/agents/auth-provider/google-credentials-provider.ts#L98-L134","documentation":"For Cloud Run hosts the provider uses an ID token; if getIdTokenClient or fetchIdToken throws, the error is wrapped with 'Failed to get ADC ID token:' and the underlying message. Causes are environmental: ADC not set up, the audience rejected, metadata server unreachable, or the credentials lack permission to mint ID tokens for that audience.","triggerScenarios":"No ADC configured locally (GOOGLE_APPLICATION_CREDENTIALS unset and no metadata server); running outside GCE/Cloud Run/Workload Identity without `gcloud auth application-default login`; the service account cannot mint tokens for the requested audience; the audience hostname does not match a deployed Cloud Run service.","commonSituations":"Developer machine without ADC; CI without Workload Identity Federation configured; pointing at a Cloud Run URL that was deleted; clock skew or metadata-server latency.","solutions":["Run `gcloud auth application-default login` on the dev machine.","In CI, configure Workload Identity Federation or set GOOGLE_APPLICATION_CREDENTIALS to a service-account key.","Confirm the audience (the Cloud Run host) corresponds to a deployed, reachable service.","Ensure the impersonated/service account has roles/iam.serviceAccountTokenCreator if cross-project."],"exampleFix":"# before - no ADC on the machine\n$ node app.js   # throws 'Failed to get ADC ID token'\n\n# after\n$ gcloud auth application-default login\n$ node app.js","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"async function withTokenRetry(fn: () => Promise<HttpHeaders>, retries = 2): Promise<HttpHeaders> {\n  for (let attempt = 0; ; attempt++) {\n    try { return await fn(); }\n    catch (e) {\n      if (attempt >= retries || !/Failed to get ADC ID token/.test((e as Error).message)) throw e;\n      await new Promise((r) => setTimeout(r, 500 * 2 ** attempt));\n    }\n  }\n}","preventionTips":["Set up ADC before running: gcloud auth application-default login.","In CI, use Workload Identity Federation, not user logins.","Verify the service account can mint tokens for the audience."],"tags":["auth","google-credentials","adc","id-token","environment"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}