{"record":{"id":"aeef178325604739","repo":"googleapis/mcp-toolbox","slug":"failed-to-find-default-google-cloud-credentials-wi-aeef17","errorCode":null,"errorMessage":"failed to find default Google Cloud credentials with scope %q: %w","messagePattern":"failed to find default Google Cloud credentials with scope %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/databaseinsights/databaseinsights.go","lineNumber":122,"sourceCode":"}\n\nfunc (s *Source) ProjectID() string {\n\treturn s.Project\n}\n\nfunc initConnection(\n\tctx context.Context,\n\ttracer trace.Tracer,\n\tname string,\n\tproject string,\n\tendpoint string,\n) (*http.Client, string, error) {\n\tctx, span := sources.InitConnectionSpan(ctx, tracer, SourceKind, name)\n\tdefer span.End()\n\n\tcred, err := google.FindDefaultCredentials(ctx, sources.CloudPlatformScope)\n\tif err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"failed to find default Google Cloud credentials with scope %q: %w\", sources.CloudPlatformScope, err)\n\t}\n\n\tuserAgent, err := util.UserAgentFromContext(ctx)\n\tif err != nil {\n\t\treturn nil, \"\", err\n\t}\n\n\t// Create authenticated HTTP client using the credentials token source\n\thttpClient := oauth2.NewClient(ctx, cred.TokenSource)\n\thttpClient.Transport = &authHeadersRoundTripper{\n\t\tconfigProject: project,\n\t\tadcProject:    cred.ProjectID,\n\t\tuserAgent:     userAgent,\n\t\tnext:          httpClient.Transport,\n\t}\n\n\tif endpoint == \"\" {\n\t\tendpoint = \"https://databaseinsights.googleapis.com\"","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/databaseinsights/databaseinsights.go#L104-L140","documentation":"This error is wrapped when google.FindDefaultCredentials fails to locate Application Default Credentials (ADC) with the cloud-platform scope during source initialization. The databaseinsights source requires authenticated Google Cloud credentials to call the Database Insights REST API, so initialization aborts if none can be found.","triggerScenarios":"Calling Initialize (via initConnection) when no ADC are present: no GOOGLE_APPLICATION_CREDENTIALS env var, no gcloud user/application-default credentials, no attached service account (GCE/Cloud Run/GKE metadata), and no well-known credentials file.","commonSituations":"Running the toolbox locally without ever running 'gcloud auth application-default login'; deploying outside GCP without mounting a service account key; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing or invalid file path.","solutions":["Run 'gcloud auth application-default login' locally to create ADC","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account JSON key file","Deploy on GCP (GCE, Cloud Run, GKE) so the metadata server supplies credentials automatically","Verify the credentials file exists, is readable, and is valid JSON with the cloud-platform scope"],"exampleFix":"// before\ncred, err := google.FindDefaultCredentials(ctx, sources.CloudPlatformScope) // fails: no ADC\n// after\n// terminal: export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json\ncred, err := google.FindDefaultCredentials(ctx, sources.CloudPlatformScope)","handlingStrategy":"validation","validationCode":"func hasADC() error {\n  if os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") != \"\" {\n    if _, err := os.Stat(os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\")); err != nil {\n      return fmt.Errorf(\"GOOGLE_APPLICATION_CREDENTIALS file missing: %w\", err)\n    }\n    return nil\n  }\n  if b, _ := exec.Command(\"gcloud\", \"auth\", \"application-default\", \"print-access-token\").Output(); len(b) > 0 {\n    return nil\n  }\n  return errors.New(\"no ADC found: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run 'gcloud auth application-default login' in every dev environment bootstrap script","Set GOOGLE_APPLICATION_CREDENTIALS explicitly in CI/deployment configs","Prefer deploying on GCP so the metadata server provides credentials","Document the required cloud-platform scope in onboarding docs"],"tags":["gcp","authentication","credentials","adc"],"backgroundTag":"missing-gcp-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}