{"record":{"id":"adffbe6fc8184e1a","repo":"calesthio/OpenMontage","slug":"google-application-credentials-is-not-set-or-point","errorCode":null,"errorMessage":"GOOGLE_APPLICATION_CREDENTIALS is not set or points to a missing file; cannot use service-account authentication.","messagePattern":"GOOGLE_APPLICATION_CREDENTIALS is not set or points to a missing file; cannot use service-account authentication\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"tools/google_credentials.py","lineNumber":118,"sourceCode":"    Raises:\n        RuntimeError: if ``google-auth`` is missing or the credentials cannot\n            be loaded/refreshed — with a message the agent can surface verbatim.\n    \"\"\"\n    if scopes is None:\n        scopes = [CLOUD_PLATFORM_SCOPE]\n\n    try:\n        from google.auth.transport.requests import Request\n        from google.oauth2 import service_account\n    except ImportError as exc:  # pragma: no cover - depends on optional dep\n        raise RuntimeError(\n            \"Service-account auth requires the 'google-auth' package. \"\n            \"Install it with: pip install google-auth\"\n        ) from exc\n\n    path = os.environ.get(\"GOOGLE_APPLICATION_CREDENTIALS\")\n    if not path or not os.path.exists(path):\n        raise RuntimeError(\n            \"GOOGLE_APPLICATION_CREDENTIALS is not set or points to a missing \"\n            \"file; cannot use service-account authentication.\"\n        )\n\n    try:\n        creds = service_account.Credentials.from_service_account_file(\n            path, scopes=scopes\n        )\n        creds.refresh(Request())\n    except Exception as exc:  # noqa: BLE001 - re-raised as actionable message\n        raise RuntimeError(\n            f\"Failed to load/refresh service-account credentials from {path}: {exc}\"\n        ) from exc\n\n    token = creds.token\n    if not token or not isinstance(token, str):\n        raise RuntimeError(\n            \"Service-account credentials did not yield a valid access token.\"","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/calesthio/OpenMontage/blob/95e1c3d0ab93482159818560f6a8c8e866b9139f/tools/google_credentials.py#L100-L136","documentation":"RuntimeError raised when the GOOGLE_APPLICATION_CREDENTIALS environment variable is unset or points to a path that does not exist on disk. The service-account flow needs a JSON key file, and this check runs before any network call so misconfiguration is reported immediately rather than as an opaque Google auth error.","triggerScenarios":"Invoking service-account auth with GOOGLE_APPLICATION_CREDENTIALS missing from the environment (env not exported, .env not loaded, different shell/deployment context) or set to a stale/moved/typo'd file path.","commonSituations":"Secrets set in a local shell but not passed to Docker/systemd/CI service context; the key file moved after rotation; relative path resolved from a different working directory; variable name typo (e.g. GOOGLE_APPLICATION_CREDENTIAL).","solutions":["Export the variable with an absolute path: `export GOOGLE_APPLICATION_CREDENTIALS=/abs/path/service-account.json`.","Verify both conditions the code checks: `echo $GOOGLE_APPLICATION_CREDENTIALS` prints a path AND `test -f \"$GOOGLE_APPLICATION_CREDENTIALS\"` succeeds.","In Docker/CI, ensure the env var is passed (-e / env: block) and the key file is actually mounted/copied into the container at that path.","Use absolute paths — relative paths break when the process cwd differs."],"exampleFix":"# before\nsubprocess.run([\"python\", \"-m\", \"app\"])  # env var not inherited -> RuntimeError\n\n# after\nimport os\nos.environ[\"GOOGLE_APPLICATION_CREDENTIALS\"] = str(key_path.resolve())\nassert Path(os.environ[\"GOOGLE_APPLICATION_CREDENTIALS\"]).is_file()\nsubprocess.run([\"python\", \"-m\", \"app\"], env=os.environ)","handlingStrategy":"validation","validationCode":"import os\nfrom pathlib import Path\n\ndef credentials_configured() -> bool:\n    path = os.environ.get(\"GOOGLE_APPLICATION_CREDENTIALS\")\n    return bool(path) and Path(path).is_file()","typeGuard":null,"tryCatchPattern":"try:\n    token, project = get_service_account_token()\nexcept RuntimeError as e:\n    if \"GOOGLE_APPLICATION_CREDENTIALS\" in str(e):\n        raise SystemExit(\"Set GOOGLE_APPLICATION_CREDENTIALS to an absolute key path\") from e\n    raise","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS to an absolute path in service/CI definitions.","Add a preflight check for the env var + file existence before starting paid work.","Load .env files explicitly in local dev so exports are not forgotten."],"tags":["google","authentication","environment","configuration","service-account"],"backgroundTag":null,"analyzedSha":"95e1c3d0ab93482159818560f6a8c8e866b9139f","analyzedAt":"2026-08-15T06:31:20.014Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}