{"record":{"id":"b9741446b8ab8a4b","repo":"googleapis/mcp-toolbox","slug":"client-side-oauth-is-enabled-but-no-access-token-w","errorCode":null,"errorMessage":"client-side OAuth is enabled but no access token was provided","messagePattern":"client-side OAuth is enabled but no access token was provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudgda/cloud_gda.go","lineNumber":131,"sourceCode":"\tif scope == \"\" {\n\t\tscope = CloudPlatformScope\n\t}\n\n\tcreds, err := google.FindDefaultCredentials(ctx, scope)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to find default credentials: %w\", err)\n\t}\n\treturn creds.TokenSource, nil\n}\n\nfunc (s *Source) UseClientAuthorization() bool {\n\treturn s.UseClientOAuth\n}\n\nfunc (s *Source) GetClient(ctx context.Context, tokenStr string) (*geminidataanalytics.DataChatClient, func(), error) {\n\tif s.UseClientOAuth {\n\t\tif tokenStr == \"\" {\n\t\t\treturn nil, nil, fmt.Errorf(\"client-side OAuth is enabled but no access token was provided\")\n\t\t}\n\t\ttoken := &oauth2.Token{AccessToken: tokenStr}\n\t\topts := []option.ClientOption{\n\t\t\toption.WithUserAgent(s.userAgent),\n\t\t\toption.WithTokenSource(oauth2.StaticTokenSource(token)),\n\t\t}\n\n\t\tclient, err := NewDataChatClient(ctx, opts...)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"failed to create per-request DataChatClient: %w\", err)\n\t\t}\n\t\treturn client, func() { client.Close() }, nil\n\t}\n\treturn s.Client, func() {}, nil\n}\n\nfunc (s *Source) RunQuery(ctx context.Context, tokenStr string, req *geminidataanalyticspb.QueryDataRequest) (*geminidataanalyticspb.QueryDataResponse, error) {\n\tclient, cleanup, err := s.GetClient(ctx, tokenStr)","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudgda/cloud_gda.go#L113-L149","documentation":"GetClient refuses to build a per-request DataChatClient when the source has UseClientOAuth enabled but the incoming request did not carry an access token. With client-side OAuth the server holds no credentials of its own, so the caller's token is mandatory.","triggerScenarios":"Configuring the cloudgda source with UseClientOAuth: true, then calling run_query without providing an authorization token in the request headers (my-auth-token/authorization token empty).","commonSituations":"Calling the tool via MCP/HTTP without setting the auth header, forgetting to configure authRequired on the tool so clients know to supply a token, or sending an empty token string after auth middleware.","solutions":["Include an OAuth access token in the request's authorization header (or the tool's configured auth token header)","Add authRequired: [my-google-auth-service] to the tool definition so clients obtain and send the token","Verify the client (e.g. MCP host) is configured to inject Google OAuth tokens","If server credentials are preferred, remove UseClientOAuth and rely on ADC"],"exampleFix":"// before\n{\n  \"tools\": {\"ask_data\": {\"source\": \"gda\"}}\n}\n// after\n{\n  \"tools\": {\"ask_data\": {\"source\": \"gda\", \"authRequired\": [\"my-google-auth-service\"]}}\n}","handlingStrategy":"validation","validationCode":"// client-side check before invoking run_query\nif useClientOAuth && token == \"\" {\n    return errors.New(\"client-side OAuth is enabled: supply an access token in the authorization header\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set authRequired on the tool when the source uses UseClientOAuth","Configure your MCP client/host to inject Google OAuth tokens automatically","Check token presence/refresh before each request","Avoid mixing UseClientOAuth sources with token-less call paths"],"tags":["cloudgda","oauth","authentication","access-token"],"backgroundTag":"missing-access-token","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}