{"record":{"id":"b50a7f0634e5f92d","repo":"kopia/kopia","slug":"unable-to-initialize-token-source","errorCode":null,"errorMessage":"unable to initialize token source","messagePattern":"unable to initialize token source","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"repo/blob/gdrive/gdrive_storage.go","lineNumber":530,"sourceCode":"\tvar err error\n\n\tvar ts oauth2.TokenSource\n\n\tscope := drive.DriveFileScope\n\tif opt.ReadOnly {\n\t\tscope = drive.DriveReadonlyScope\n\t}\n\n\tif sa := opt.ServiceAccountCredentialJSON; len(sa) > 0 {\n\t\tts, err = tokenSourceFromCredentialsJSON(ctx, sa, scope)\n\t} else if sa := opt.ServiceAccountCredentialsFile; sa != \"\" {\n\t\tts, err = tokenSourceFromCredentialsFile(ctx, sa, scope)\n\t} else {\n\t\tts, err = google.DefaultTokenSource(ctx, scope)\n\t}\n\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"unable to initialize token source\")\n\t}\n\n\thc := oauth2.NewClient(ctx, ts)\n\n\tservice, err := drive.NewService(ctx, option.WithHTTPClient(hc))\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"unable to create Drive client\")\n\t}\n\n\treturn service, nil\n}\n\n// New creates new Google Drive-backed storage with specified options:\n//\n// - the 'folderID' field is required and all other parameters are optional.\n//\n// By default the connection reuses credentials managed by (https://cloud.google.com/sdk/),\n// but this can be disabled by setting IgnoreDefaultCredentials to true.","sourceCodeStart":512,"sourceCodeEnd":548,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/repo/blob/gdrive/gdrive_storage.go#L512-L548","documentation":"CreateDriveService obtains an oauth2.TokenSource: from inline SA JSON, from a SA credentials file, or from google.DefaultTokenSource (Application Default Credentials). Any failure in this step — unreadable key, unparseable key, or no default credentials available — is wrapped as 'unable to initialize token source' and prevents creating the Drive client.","triggerScenarios":"Calling New/CreateDriveService when: no ServiceAccountCredentialJSON/File is configured and GOOGLE_APPLICATION_CREDENTIALS is unset with no gcloud ADC present; or the configured credential path/JSON is unreadable/invalid (the underlying cause is errors 1234-1236).","commonSituations":"Running locally without `gcloud auth application-default login`, containers missing GOOGLE_APPLICATION_CREDENTIALS, wrong service-account key content, or metadata-server unreachable on GCP.","solutions":["Check the inner error in the wrapped chain to distinguish bad credentials (fix key JSON/path) from missing default credentials.","If not using a service account: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a valid SA key JSON.","If using a service account: verify the key file/JSON parses (see errors 1234-1236 fixes).","Confirm the Drive API is enabled in the credential's Google Cloud project."],"exampleFix":"// before: no credentials anywhere\nctx := context.Background()\nsvc, err := gdrive.CreateDriveService(ctx, &gdrive.Options{FolderID: id})\n\n// after: supply service-account credentials\nsvc, err := gdrive.CreateDriveService(ctx, &gdrive.Options{\n    FolderID:                      id,\n    ServiceAccountCredentialsFile: \"/etc/kopia/gdrive-sa.json\",\n})","handlingStrategy":"validation","validationCode":"// ensure ADC is available when no SA credentials are configured\nif saFile == \"\" && len(saJSON) == 0 && os.Getenv(\"GOOGLE_APPLICATION_CREDENTIALS\") == \"\" {\n    _, err := google.FindDefaultCredentials(ctx, drive.DriveFileScope)\n    if err != nil {\n        return errors.New(\"no credentials: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"unable to initialize token source\") {\n    // inspect the wrapped cause: bad key JSON vs no default credentials\n}","preventionTips":["Always supply service-account credentials explicitly OR run `gcloud auth application-default login` first.","Set GOOGLE_APPLICATION_CREDENTIALS in containers and CI.","Validate the SA key JSON before wiring it into options.","Enable the Drive API in the credential's Google Cloud project."],"tags":["gdrive","oauth","credentials","adc"],"backgroundTag":"missing-credentials","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}