{"record":{"id":"b98c2fabd9e4e583","repo":"googleworkspace/cli","slug":"no-credentials-found-run-gws-auth-setup-to-conf","errorCode":null,"errorMessage":"No credentials found. Run `gws auth setup` to configure, `gws auth login` to authenticate, or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE.\nTip: Application Default Credentials (ADC) are also supported — run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS.","messagePattern":"No credentials found\\. Run `gws auth setup` to configure, `gws auth login` to authenticate, or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE\\.\nTip: Application Default Credentials \\(ADC\\) are also supported — run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/google-workspace-cli/src/auth.rs","lineNumber":428,"sourceCode":"            return parse_credential_file(&adc_path, &content).await;\n        }\n        anyhow::bail!(\n            \"GOOGLE_APPLICATION_CREDENTIALS points to {adc_env}, but file does not exist\"\n        );\n    }\n\n    // 4b. Well-known ADC path: ~/.config/gcloud/application_default_credentials.json\n    // (populated by `gcloud auth application-default login`). Silent if absent.\n    if let Some(well_known) = adc_well_known_path() {\n        if well_known.exists() {\n            let content = tokio::fs::read_to_string(&well_known)\n                .await\n                .with_context(|| format!(\"Failed to read ADC from {}\", well_known.display()))?;\n            return parse_credential_file(&well_known, &content).await;\n        }\n    }\n\n    anyhow::bail!(\n        \"No credentials found. Run `gws auth setup` to configure, \\\n         `gws auth login` to authenticate, or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE.\\n\\\n         Tip: Application Default Credentials (ADC) are also supported — run \\\n         `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS.\"\n    )\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use std::io::Write;\n    use tempfile::NamedTempFile;\n\n    /// RAII guard that saves the current value of an environment variable and\n    /// restores it when dropped. This ensures cleanup even if a test panics.\n    struct EnvVarGuard {\n        name: String,\n        original: Option<std::ffi::OsString>,","sourceCodeStart":410,"sourceCodeEnd":446,"githubUrl":"https://github.com/googleworkspace/cli/blob/a3768d0e82ad83cca2da97724e46bea4ff0e6dbd/crates/google-workspace-cli/src/auth.rs#L410-L446","documentation":"Terminal failure of the credential waterfall: no GOOGLE_WORKSPACE_CLI_TOKEN, no GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE, no encrypted credentials, no GOOGLE_APPLICATION_CREDENTIALS, and no well-known gcloud ADC file (~/.config/gcloud/application_default_credentials.json). The message enumerates every way to fix it, including the ADC tip.","triggerScenarios":"First run on a fresh machine/container before any `gws auth` command; HOME unset or redirected so ~/.config/gws does not exist; all auth env vars stripped in CI; encrypted credentials deleted by `gws auth logout` and never re-established.","commonSituations":"New developer cloning the repo; Docker/CI image with no mounted config and no env vars; running under a different user (sudo) whose HOME lacks ~/.config/gws; logout run to clear a bad state and forgotten.","solutions":["Interactive setup: `gws auth setup` (wizard) or `gws auth login` (browser OAuth)","Headless/CI: set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to a service-account or authorized-user JSON","Reuse gcloud: `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS","One-shot: export GOOGLE_WORKSPACE_CLI_TOKEN with a pre-obtained access token"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Preflight: fail fast with your own message before any API call\nuse anyhow::{Context, Result};\n\nasync fn ensure_credentials() -> Result<()> {\n    if std::env::var_os(\"GOOGLE_WORKSPACE_CLI_TOKEN\").is_some() { return Ok(()); }\n    if let Ok(p) = std::env::var(\"GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE\") {\n        if std::path::Path::new(&p).is_file() { return Ok(()); }\n    }\n    if std::path::Path::new(\"~/.config/gws/.placeholder_expanded_manually\").exists() { /* encrypted creds present check */ }\n    anyhow::bail!(\"no credentials configured — run `gws auth login` first\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make `gws auth status` the first step of any scripted workflow to surface missing credentials before real work","In CI, decide one method (plaintext credentials file or GOOGLE_WORKSPACE_CLI_TOKEN) and assert it is set at job start","Bake `gcloud auth application-default login` (or activate-key) into image provisioning when reusing gcloud auth"],"tags":["adc","auth","onboarding","credentials"],"backgroundTag":"application-default-credentials-not-found","analyzedSha":"a3768d0e82ad83cca2da97724e46bea4ff0e6dbd","analyzedAt":"2026-08-16T19:51:46.516Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}