{"record":{"id":"97973830d3a907c2","repo":"googleapis/mcp-toolbox","slug":"failed-to-find-default-google-cloud-credentials","errorCode":null,"errorMessage":"failed to find default Google Cloud credentials: %w","messagePattern":"failed to find default Google Cloud credentials: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":953,"sourceCode":"\n\t\tif impersonateServiceAccount != \"\" {\n\t\t\t// Create impersonated credentials token source\n\t\t\tts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{\n\t\t\t\tTargetPrincipal: impersonateServiceAccount,\n\t\t\t\tScopes:          credScopes,\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"failed to create impersonated credentials for %q: %w\", impersonateServiceAccount, err)\n\t\t\t}\n\t\t\topts = []option.ClientOption{\n\t\t\t\toption.WithUserAgent(userAgent),\n\t\t\t\toption.WithTokenSource(ts),\n\t\t\t}\n\t\t} else {\n\t\t\t// Use default credentials\n\t\t\tcred, err := google.FindDefaultCredentials(ctx, credScopes...)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, nil, fmt.Errorf(\"failed to find default Google Cloud credentials: %w\", err)\n\t\t\t}\n\t\t\topts = []option.ClientOption{\n\t\t\t\toption.WithUserAgent(userAgent),\n\t\t\t\toption.WithCredentials(cred),\n\t\t\t}\n\t\t}\n\n\t\tclient, err = dataplexapi.NewCatalogClient(ctx, opts...)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"failed to create Dataplex client for project %q: %w\", project, err)\n\t\t}\n\t}\n\n\treturn client, clientCreator, nil\n}\n\nfunc initDataplexConnectionWithOAuthToken(\n\tctx context.Context,","sourceCodeStart":935,"sourceCodeEnd":971,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L935-L971","documentation":"This error is thrown when google.FindDefaultCredentials() (golang.org/x/oauth2/google) cannot locate Application Default Credentials (ADC) for the requested scopes during Dataplex client setup, in the non-impersonation path. ADC resolution checks GOOGLE_APPLICATION_CREDENTIALS, gcloud user credentials, GCE/Metadata server, and workload identity in order. Failure means none of these sources yielded usable credentials.","triggerScenarios":"Running initDataplexConnection with no `impersonateServiceAccount` configured and no credentials available: GOOGLE_APPLICATION_CREDENTIALS unset or pointing to a missing/invalid file, no `gcloud auth application-default login` performed locally, and no attached service account (not on GCE/GKE/Cloud Run), or the key file fails to parse for the requested scopes.","commonSituations":"Running the toolbox locally for the first time without authenticating; GOOGLE_APPLICATION_CREDENTIALS pointing at a deleted or malformed JSON key; Docker containers without the credential file mounted; GKE workloads without Workload Identity enabled; empty/stale gcloud credential store.","solutions":["Run `gcloud auth application-default login` on your dev machine to create ADC.","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key file and verify it parses: `cat $GOOGLE_APPLICATION_CREDENTIALS | jq .client_email`.","If in Docker/K8s, mount the key file or enable Workload Identity / attach a service account to the compute resource.","Ensure the key's service account still exists and the key is not disabled/revoked in IAM.","If impersonation was intended, set the `impersonateServiceAccount` config field so this ADC path is bypassed."],"exampleFix":"// before (shell)\n./toolbox  # error: could not find default credentials\n// after (shell)\ngcloud auth application-default login\nexport GOOGLE_APPLICATION_CREDENTIALS=$HOME/.config/gcloud/application_default_credentials.json\n./toolbox","handlingStrategy":"validation","validationCode":"// pre-check ADC before invoking the library:\nif os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") != \"\" {\n    if _, err := os.Stat(os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")); err != nil {\n        return fmt.Errorf(\"GOOGLE_APPLICATION_CREDENTIALS points to missing file\")\n    }\n} else if _, err := exec.LookPath(\"gcloud\"); err == nil {\n    if err := exec.Command(\"gcloud\", \"auth\", \"application-default\", \"print-access-token\").Run(); err != nil {\n        return fmt.Errorf(\"no ADC: run 'gcloud auth application-default login'\")\n    }\n}","typeGuard":"func isMissingADCErr(err error) bool {\n    return err != nil && (strings.Contains(err.Error(), \"could not find default credentials\") ||\n        strings.Contains(err.Error(), \"failed to find default Google Cloud credentials\"))\n}","tryCatchPattern":"client, creator, err := initDataplexConnection(ctx, tracer, name, project, false, \"\", scopes)\nif isMissingADCErr(err) {\n    return fmt.Errorf(\"authenticate first: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS: %w\", err)\n}","preventionTips":["Run `gcloud auth application-default login` as a documented setup step for local development.","Validate GOOGLE_APPLICATION_CREDENTIALS at process start (file exists, JSON parses, key not revoked).","Mount credentials or enable Workload Identity in containerized/K8s deployments.","Prefer impersonation config (`impersonateServiceAccount`) in CI so ADC absence fails fast with a clear message."],"tags":["gcp","authentication","adc","environment"],"backgroundTag":"missing-default-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}