{"record":{"id":"990d8497053f9337","repo":"GoogleContainerTools/skaffold","slug":"failed-to-get-access-token-v","errorCode":null,"errorMessage":"failed to get access token %v","messagePattern":"failed to get access token (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/gcp/auth.go","lineNumber":78,"sourceCode":"\t\t}\n\t}\n}\n\ntype token struct {\n\tToken string `json:\"token\"`\n}\n\ntype tokenSource struct {\n}\n\nfunc (ts tokenSource) Token() (*oauth2.Token, error) {\n\t// the command return a json object containing token\n\tcmd := exec.Command(\"gcloud\", \"auth\", \"print-access-token\", \"--format=json\")\n\tvar body bytes.Buffer\n\tcmd.Stdout = &body\n\terr := util.RunCmd(context.TODO(), cmd)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get access token %v\", err)\n\t}\n\tvar t token\n\tif err := json.Unmarshal(body.Bytes(), &t); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to unmarshal gcloud command result into access token %v\", err)\n\t}\n\treturn &oauth2.Token{AccessToken: t.Token}, nil\n}\n\nfunc activeUserCredentialsOnce() (*google.Credentials, error) {\n\tcredsOnce.Do(func() {\n\t\tc, err := activeUserCredentials()\n\t\tif err != nil {\n\t\t\tlog.Entry(context.TODO()).Infof(\"unable to retrieve gcloud access token: %v\", err)\n\t\t\tlog.Entry(context.TODO()).Info(\"falling back to application default credentials\")\n\t\t\tcredsErr = fmt.Errorf(\"retrieving gcloud access token: %w\", err)\n\t\t\treturn\n\t\t}\n\t\tcreds = c","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/gcp/auth.go#L60-L96","documentation":"The gcp package's Token implementation shells out to `gcloud auth print-access-token --format=json` to obtain an OAuth2 token for the active gcloud user. If the gcloud command exits nonzero, the error is wrapped as 'failed to get access token'.","triggerScenarios":"Calling activeUserCredentials (via credential-resolution flows) when gcloud is not installed, the user is not logged in, gcloud cannot reach the token endpoint, or the command fails for any other reason.","commonSituations":"Fresh machine or CI container where `gcloud auth login` was never run; PATH missing gcloud; revoked credentials; corporate proxy blocking gcloud's network calls.","solutions":["Run `gcloud auth login` (or `gcloud auth application-default login`) to establish credentials.","Verify gcloud is installed and on PATH: `which gcloud && gcloud auth list`.","Check the wrapped cause from util.RunCmd for the gcloud stderr message.","Set GOOGLE_APPLICATION_CREDENTIALS to a service-account key if gcloud user auth is unavailable in CI."],"exampleFix":"// before\n$ skaffold ... # failed to get access token: exit status 1 (no active account)\n// after\n$ gcloud auth login\n$ gcloud config set account you@example.com","handlingStrategy":"try-catch","validationCode":"// Pre-flight: is gcloud installed and authenticated?\nif _, err := exec.LookPath(\"gcloud\"); err != nil {\n    return fmt.Errorf(\"gcloud not found on PATH\")\n}\nout, err := exec.Command(\"gcloud\", \"auth\", \"list\", \"--format=json\", \"--filter=status:ACTIVE\").Output()\nif err != nil || len(out) < 4 {\n    return fmt.Errorf(\"no active gcloud account; run `gcloud auth login`\")\n}","typeGuard":null,"tryCatchPattern":"tok, err := tokenSource.Token()\nif err != nil && strings.Contains(err.Error(), \"failed to get access token\") {\n    return fmt.Errorf(\"run `gcloud auth login` or set GOOGLE_APPLICATION_CREDENTIALS: %w\", err)\n}","preventionTips":["Run `gcloud auth login` on dev machines; use service-account keys in CI.","Keep gcloud on PATH for the process user.","Refresh credentials periodically; gcloud tokens expire.","Use ADC/metadata-server credentials on GCP-hosted workloads instead of shelling out to gcloud."],"tags":["gcp","gcloud","auth","token","exec"],"backgroundTag":"gcloud-auth-failed","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}