{"record":{"id":"cf5e19bf59d6279c","repo":"googleapis/mcp-toolbox","slug":"failed-to-find-default-google-cloud-credentials-fo-cf5e19","errorCode":null,"errorMessage":"failed to find default Google Cloud credentials for project %q: %w","messagePattern":"failed to find default Google Cloud credentials for project %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/dataplex/dataplex.go","lineNumber":219,"sourceCode":"\n\tif impersonateServiceAccount != \"\" {\n\t\t// Create impersonated credentials token source\n\t\tts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{\n\t\t\tTargetPrincipal: impersonateServiceAccount,\n\t\t\tScopes:          credScopes,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, nil, fmt.Errorf(\"failed to create impersonated credentials for %q for project %q: %w\", impersonateServiceAccount, project, err)\n\t\t}\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithTokenSource(ts),\n\t\t}\n\t} else {\n\t\t// Use default credentials\n\t\tcred, err := google.FindDefaultCredentials(ctx, credScopes...)\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, nil, fmt.Errorf(\"failed to find default Google Cloud credentials for project %q: %w\", project, err)\n\t\t}\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithCredentials(cred),\n\t\t}\n\t}\n\n\tclient, err := dataplexapi.NewCatalogClient(ctx, opts...)\n\tif err != nil {\n\t\treturn nil, nil, nil, nil, fmt.Errorf(\"failed to create Dataplex client for project %q: %w\", project, err)\n\t}\n\n\tdataScanClient, err := dataplexapi.NewDataScanClient(ctx, opts...)\n\tif err != nil {\n\t\tclient.Close()\n\t\treturn nil, nil, nil, nil, fmt.Errorf(\"failed to create Dataplex DataScan client for project %q: %w\", project, err)\n\t}\n","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/dataplex/dataplex.go#L201-L237","documentation":"When no impersonation is configured, the source falls back to Application Default Credentials via google.FindDefaultCredentials with the configured scopes. This error means no usable ADC could be located in the environment, so the Dataplex clients cannot be built. It is the classic 'no credentials found' initialization failure.","triggerScenarios":"initDataplexConnection with empty impersonateServiceAccount calls google.FindDefaultCredentials(ctx, credScopes...) and no credential chain matches: no GOOGLE_APPLICATION_CREDENTIALS, no gcloud user creds, no metadata server (e.g. outside GCP without a key file).","commonSituations":"Running the toolbox locally without `gcloud auth application-default login`; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing/deleted key file; container without a mounted SA key; malformed credentials JSON.","solutions":["Run `gcloud auth application-default login` on your local machine.","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account key JSON: `export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json` and confirm the file exists and parses.","If running on GCP, attach a service account to the compute resource (VM/Cloud Run/GKE) instead of relying on key files.","If you meant to impersonate, set the `impersonateServiceAccount` field in the source config.","Regenerate the key file if it was revoked/deleted, and validate the JSON is well-formed."],"exampleFix":"// before (shell)\n./toolbox --tools-file tools.yaml   # no ADC present\n// after (shell)\ngcloud auth application-default login\n./toolbox --tools-file tools.yaml","handlingStrategy":"validation","validationCode":"test -n \"$GOOGLE_APPLICATION_CREDENTIALS\" && test -f \"$GOOGLE_APPLICATION_CREDENTIALS\" && echo ok || gcloud auth application-default print-access-token >/dev/null && echo ok || echo 'no ADC found'","typeGuard":null,"tryCatchPattern":"src, err := cfg.Initialize(ctx, tracer)\nif err != nil {\n\tif strings.Contains(err.Error(), \"failed to find default Google Cloud credentials\") {\n\t\tlog.Fatalf(\"no Application Default Credentials; run 'gcloud auth application-default login': %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Run `gcloud auth application-default login` in every dev environment.","Set and verify GOOGLE_APPLICATION_CREDENTIALS in CI/containers before launching the toolbox.","On GCP, prefer attached service accounts over key files.","Validate credential JSON files after rotation to catch deleted/revoked keys."],"tags":["gcp","authentication","adc","dataplex","initialization"],"backgroundTag":"missing-application-default-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}