{"record":{"id":"b12d3758875e2618","repo":"googleapis/mcp-toolbox","slug":"failed-to-find-default-credentials-run-gcloud-au","errorCode":null,"errorMessage":"failed to find default credentials (run 'gcloud auth application-default login'?): %w","messagePattern":"failed to find default credentials \\(run 'gcloud auth application-default login'\\?\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/util.go","lineNumber":149,"sourceCode":"\tcase \"postgres\":\n\t\t// service account email used for IAM should trim the suffix\n\t\tusername = strings.TrimSuffix(fullEmail, \".gserviceaccount.com\")\n\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"unsupported dbType: %s. Use 'mysql' or 'postgres'\", dbType)\n\t}\n\n\tif username == \"\" {\n\t\treturn \"\", fmt.Errorf(\"username from ADC cannot be an empty string\")\n\t}\n\n\treturn username, nil\n}\n\nfunc GetIAMAccessToken(ctx context.Context) (string, error) {\n\tcreds, err := google.FindDefaultCredentials(ctx, \"https://www.googleapis.com/auth/cloud-platform\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to find default credentials (run 'gcloud auth application-default login'?): %w\", err)\n\t}\n\n\ttoken, err := creds.TokenSource.Token() // This gets an oauth2.Token\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get token from token source: %w\", err)\n\t}\n\n\tif !token.Valid() {\n\t\treturn \"\", fmt.Errorf(\"retrieved token is invalid or expired\")\n\t}\n\treturn token.AccessToken, nil\n}\n","sourceCodeStart":131,"sourceCodeEnd":162,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/util.go#L131-L162","documentation":"GetIAMAccessToken calls google.FindDefaultCredentials to locate Application Default Credentials for the cloud-platform scope. When no usable ADC can be found (no gcloud user credentials, no GOOGLE_APPLICATION_CREDENTIALS, no attached service account, etc.), the underlying error is wrapped with this message to point the developer at the most common fix: running 'gcloud auth application-default login'.","triggerScenarios":"Any call to GetIAMAccessToken (used by BigQuery tools and Cloud SQL IAM auth) in an environment where ADC resolution fails: fresh machine, CI container without credentials, or GOOGLE_APPLICATION_CREDENTIALS pointing at a missing/invalid file.","commonSituations":"Local development on a new machine before ever running 'gcloud auth application-default login'; Docker/CI environments with no GCP credentials mounted; a typo'd or deleted path in GOOGLE_APPLICATION_CREDENTIALS; running on a VM without a service account attached.","solutions":["Run 'gcloud auth application-default login' locally to create user ADC","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account JSON key file","In GCP environments (GCE/GKE/Cloud Run), attach a service account to the workload","In CI, inject credentials via the workload identity federation or a mounted key file"],"exampleFix":"// before: no credentials in environment\n// (error at runtime)\n// after\ngcloud auth application-default login\n# or\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json","handlingStrategy":"fallback","validationCode":"import { GoogleAuth } from \"google-auth-library\";\ntry {\n  const auth = new GoogleAuth({ scopes: [\"https://www.googleapis.com/auth/cloud-platform\"] });\n  const client = await auth.getClient(); // throws early if no ADC\n} catch (e) {\n  console.error(\"No ADC found; run 'gcloud auth application-default login'\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  const token = await getIAMAccessToken(ctx);\n} catch (err) {\n  if (String(err).includes(\"failed to find default credentials\")) {\n    // surface remediation hint or fall back to explicit credentials\n    process.env.GOOGLE_APPLICATION_CREDENTIALS ??= \"/path/to/key.json\";\n  }\n  throw err;\n}","preventionTips":["Document the 'gcloud auth application-default login' prerequisite for local dev","Provision workload identity/attached service accounts in GCP deployments","In CI, inject credentials via workload identity federation instead of relying on ambient ADC","Never leave GOOGLE_APPLICATION_CREDENTIALS pointing at missing files"],"tags":["google-cloud","authentication","adc","environment"],"backgroundTag":"adc-credentials-missing","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}