{"record":{"id":"d9f80d16fff88288","repo":"googleworkspace/cli","slug":"google-application-credentials-points-to-adc-env","errorCode":null,"errorMessage":"GOOGLE_APPLICATION_CREDENTIALS points to {adc_env}, but file does not exist","messagePattern":"GOOGLE_APPLICATION_CREDENTIALS points to (.+?), but file does not exist","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/google-workspace-cli/src/auth.rs","lineNumber":412,"sourceCode":"        return Ok(Credential::AuthorizedUser(\n            yup_oauth2::read_authorized_user_secret(default_path)\n                .await\n                .with_context(|| {\n                    format!(\"Failed to read credentials from {}\", default_path.display())\n                })?,\n        ));\n    }\n\n    // 4a. GOOGLE_APPLICATION_CREDENTIALS env var (explicit path — hard error if missing)\n    if let Ok(adc_env) = std::env::var(\"GOOGLE_APPLICATION_CREDENTIALS\") {\n        let adc_path = PathBuf::from(&adc_env);\n        if adc_path.exists() {\n            let content = tokio::fs::read_to_string(&adc_path)\n                .await\n                .with_context(|| format!(\"Failed to read ADC from {adc_env}\"))?;\n            return parse_credential_file(&adc_path, &content).await;\n        }\n        anyhow::bail!(\n            \"GOOGLE_APPLICATION_CREDENTIALS points to {adc_env}, but file does not exist\"\n        );\n    }\n\n    // 4b. Well-known ADC path: ~/.config/gcloud/application_default_credentials.json\n    // (populated by `gcloud auth application-default login`). Silent if absent.\n    if let Some(well_known) = adc_well_known_path() {\n        if well_known.exists() {\n            let content = tokio::fs::read_to_string(&well_known)\n                .await\n                .with_context(|| format!(\"Failed to read ADC from {}\", well_known.display()))?;\n            return parse_credential_file(&well_known, &content).await;\n        }\n    }\n\n    anyhow::bail!(\n        \"No credentials found. Run `gws auth setup` to configure, \\\n         `gws auth login` to authenticate, or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE.\\n\\","sourceCodeStart":394,"sourceCodeEnd":430,"githubUrl":"https://github.com/googleworkspace/cli/blob/a3768d0e82ad83cca2da97724e46bea4ff0e6dbd/crates/google-workspace-cli/src/auth.rs#L394-L430","documentation":"Credential resolution step 4a honors the standard GOOGLE_APPLICATION_CREDENTIALS variable. Like the gws-specific variable, an explicitly set path that does not exist is a hard error: silently skipping user-mandated ADC would mask the misconfiguration and fall through to a confusing 'no credentials' failure later.","triggerScenarios":"Variable points to a file absent from the current container/runner; path with unexpanded ~ or $HOME; wrong quoting in systemd units, cron, or docker; file removed after `gcloud auth application-default revoke`.","commonSituations":"Kubernetes secret not mounted at the path the env var references; cron job environment missing HOME expansion; stale env var left in a shell profile after the JSON was deleted; CI base image changed and no longer copies the file.","solutions":["Verify with: printf '%s\\n' \"$GOOGLE_APPLICATION_CREDENTIALS\" && ls -la \"$GOOGLE_APPLICATION_CREDENTIALS\"","Fix the path to an absolute one that exists in the runtime environment","If ADC was revoked, re-run `gcloud auth application-default login` to regenerate the well-known file","If ADC is not wanted, unset the variable so gws falls back to its own credentials"],"exampleFix":"# before (unexpanded HOME in a systemd unit)\nEnvironment=GOOGLE_APPLICATION_CREDENTIALS=~/.config/gcp/sa.json\n\n# after\nEnvironment=GOOGLE_APPLICATION_CREDENTIALS=/home/youruser/.config/gcp/sa.json","handlingStrategy":"validation","validationCode":"// Preflight ADC before running the real workload\nif let Ok(p) = std::env::var(\"GOOGLE_APPLICATION_CREDENTIALS\") {\n    assert!(std::path::Path::new(&p).is_file(),\n        \"GOOGLE_APPLICATION_CREDENTIALS={p} does not exist\");\n} else if !std::path::Path::new(&format!(\"{}/.config/gcloud/application_default_credentials.json\", std::env::var(\"HOME\").unwrap_or_default())).exists() {\n    eprintln!(\"warning: no ADC configured — run `gcloud auth application-default login` first\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify the variable with `ls -la \"$GOOGLE_APPLICATION_CREDENTIALS\"` in CI before the job's main step","Use absolute paths in systemd units, cron, and docker — those environments do not expand ~ either","Unset the variable when you switch away from ADC so resolution falls through predictably"],"tags":["adc","credentials","env-var","gcloud"],"backgroundTag":"credentials-file-not-found","analyzedSha":"a3768d0e82ad83cca2da97724e46bea4ff0e6dbd","analyzedAt":"2026-08-16T19:51:46.516Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}