{"record":{"id":"b38cac87adc1faac","repo":"hashicorp/terraform","slug":"the-string-provided-in-credentials-is-neither-vali","errorCode":null,"errorMessage":"the string provided in credentials is neither valid json nor a valid file path","messagePattern":"the string provided in credentials is neither valid json nor a valid file path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/gcs/backend.go","lineNumber":204,"sourceCode":"\t} else {\n\t\tcreds = os.Getenv(\"GOOGLE_CREDENTIALS\")\n\t}\n\n\tif tokenSource != nil {\n\t\tcredOptions = append(credOptions, option.WithTokenSource(tokenSource))\n\t} else if creds != \"\" {\n\n\t\t// to mirror how the provider works, we accept the file path or the contents\n\t\tcontents, err := readPathOrContents(creds)\n\t\tif err != nil {\n\t\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\t\tfmt.Errorf(\"Error loading credentials: %s\", err),\n\t\t\t)\n\t\t}\n\n\t\tif !json.Valid([]byte(contents)) {\n\t\t\treturn backendbase.ErrorAsDiagnostics(\n\t\t\t\tfmt.Errorf(\"the string provided in credentials is neither valid json nor a valid file path\"),\n\t\t\t)\n\t\t}\n\n\t\tcredOptions = append(credOptions, option.WithCredentialsJSON([]byte(contents)))\n\t}\n\n\t// Service Account Impersonation\n\tif v := data.String(\"impersonate_service_account\"); v != \"\" {\n\t\tServiceAccount := v\n\t\tvar delegates []string\n\n\t\tdelegatesVal := data.GetAttr(\"impersonate_service_account_delegates\", cty.List(cty.String))\n\t\tif !delegatesVal.IsNull() && delegatesVal.LengthInt() != 0 {\n\t\t\tdelegates = make([]string, 0, delegatesVal.LengthInt())\n\t\t\tfor it := delegatesVal.ElementIterator(); it.Next(); {\n\t\t\t\t_, v := it.Element()\n\t\t\t\tif v.IsNull() {\n\t\t\t\t\treturn backendbase.ErrorAsDiagnostics(","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/gcs/backend.go#L186-L222","documentation":"Raised by the GCS backend when the 'credentials' string is not valid JSON and readPathOrContents did not treat it as a readable file path (no read error), so it is neither a JSON blob nor a loadable file. The backend refuses to pass garbage to the GCS client. This is the catch-all for a malformed credentials value.","triggerScenarios":"At backend.go:202-205: after readPathOrContents succeeds (returns a string), json.Valid([]byte(contents)) is false. Triggered when credentials is a non-JSON string that is also not an existing file path — e.g. a truncated key, a base64 blob, a service-account email, or pasted JSON with stray characters.","commonSituations":"Pasted the service-account email instead of the key JSON; pasted JSON that lost quotes/newlines through shell escaping; provided a base64-encoded key where raw JSON was expected; credentials file path was actually valid as a string but the file does not exist AND the string is not JSON (note: this fires when readPathOrContents returns the string unchanged because it is not a path).","solutions":["Provide the full service-account JSON key (download from GCP IAM > Service accounts > Keys) inline or via a readable file path.","Validate the JSON before using: 'echo \"$CREDENTIALS\" | jq .' or 'python -m json.tool sa.json'.","Avoid shell mangling: write the key to a file and reference the path, or export it via a heredoc.","Confirm you are not passing the OAuth access_token, email, or project id in the 'credentials' field."],"exampleFix":"# before: pasted email / mangled string -> 219\ncredentials = \"tf-sa@my-project.iam.gserviceaccount.com\"\n# after: full service-account JSON\ncredentials = file(\"/abs/path/sa.json\")\n# validate first\njq empty /abs/path/sa.json && echo \"valid json\"","handlingStrategy":"validation","validationCode":"// Validate the credentials value is JSON or a path to JSON before init.\nfunc validateCreds(creds string) error {\n    if json.Valid([]byte(creds)) { return nil }\n    b, err := os.ReadFile(creds)\n    if err != nil {\n        return fmt.Errorf(\"the string provided in credentials is neither valid json nor a valid file path\")\n    }\n    if !json.Valid(b) {\n        return fmt.Errorf(\"credentials file %q is not valid JSON\", creds)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide the full service-account JSON key (inline or via file()).","Validate with 'jq .' or 'python -m json.tool' before use.","Do not paste the service-account email or a base64 blob into 'credentials'.","Avoid shell mangling by storing the key in a file referenced by absolute path."],"tags":["gcs","google-cloud","credentials","json","config","auth","validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}