{"record":{"id":"b3e52335014de89e","repo":"infiniflow/ragflow","slug":"unable-to-access-source-service-account-creden","errorCode":null,"errorMessage":"Unable to access {source} - service account credentials are invalid.","messagePattern":"Unable to access (.+?) - service account credentials are invalid\\.","errorType":"exception","errorClass":"PermissionError","httpStatus":null,"severity":"error","filePath":"common/data_source/google_util/auth.py","lineNumber":119,"sourceCode":"                    oauth_creds_json_str = oauth_creds.to_json()\n\n                new_creds_dict = {\n                    DB_CREDENTIALS_DICT_TOKEN_KEY: oauth_creds_json_str,\n                    DB_CREDENTIALS_PRIMARY_ADMIN_KEY: credentials[DB_CREDENTIALS_PRIMARY_ADMIN_KEY],\n                    DB_CREDENTIALS_AUTHENTICATION_METHOD: authentication_method,\n                }\n    elif DB_CREDENTIALS_DICT_SERVICE_ACCOUNT_KEY in credentials:\n        # SERVICE ACCOUNT\n        service_account_key_json_str = credentials[DB_CREDENTIALS_DICT_SERVICE_ACCOUNT_KEY]\n        service_account_key = json.loads(service_account_key_json_str)\n\n        service_creds = ServiceAccountCredentials.from_service_account_info(service_account_key, scopes=GOOGLE_SCOPES[source])\n\n        if not service_creds.valid or not service_creds.expired:\n            service_creds.refresh(Request())\n\n        if not service_creds.valid:\n            raise PermissionError(f\"Unable to access {source} - service account credentials are invalid.\")\n\n    creds: ServiceAccountCredentials | OAuthCredentials | None = oauth_creds or service_creds\n    if creds is None:\n        raise PermissionError(f\"Unable to access {source} - unknown credential structure.\")\n\n    return creds, new_creds_dict\n\n\ndef get_google_oauth_creds(token_json_str: str, source: DocumentSource) -> OAuthCredentials | None:\n    \"\"\"creds_json only needs to contain client_id, client_secret and refresh_token to\n    refresh the creds.\n\n    expiry and token are optional ... however, if passing in expiry, token\n    should also be passed in or else we may not return any creds.\n    (probably a sign we should refactor the function)\n    \"\"\"\n\n    creds_json = json.loads(token_json_str)","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/data_source/google_util/auth.py#L101-L137","documentation":"Error \"Unable to access {source} - service account credentials are invalid.\" thrown in infiniflow/ragflow.","triggerScenarios":"Thrown at common/data_source/google_util/auth.py:119 when the library encounters an invalid state.","commonSituations":"The service account key was deleted, the account disabled, or the resource not shared with it; fixing IAM access prevents this error.","solutions":["Verify the service account key JSON is valid and not deleted in Cloud Console.","Ensure the service account has access to the target resource."],"exampleFix":"# Cloud Console: IAM > Service Accounts > create new key; share resources with the SA email","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}