{"record":{"id":"da611175483ea033","repo":"googleapis/mcp-toolbox","slug":"failed-to-find-default-google-cloud-credentials-wi","errorCode":null,"errorMessage":"failed to find default Google Cloud credentials with scopes %v: %w","messagePattern":"failed to find default Google Cloud credentials with scopes (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":799,"sourceCode":"\t\t// Create impersonated credentials token source\n\t\t// This broader scope is needed for tools like conversational analytics\n\t\tcloudPlatformTokenSource, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{\n\t\t\tTargetPrincipal: impersonateServiceAccount,\n\t\t\tScopes:          credScopes,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"failed to create impersonated credentials for %q: %w\", impersonateServiceAccount, err)\n\t\t}\n\t\ttokenSource = cloudPlatformTokenSource\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithTokenSource(cloudPlatformTokenSource),\n\t\t}\n\t} else {\n\t\t// Use default credentials\n\t\tcred, err := google.FindDefaultCredentials(ctx, credScopes...)\n\t\tif err != nil {\n\t\t\treturn nil, nil, nil, fmt.Errorf(\"failed to find default Google Cloud credentials with scopes %v: %w\", credScopes, err)\n\t\t}\n\t\ttokenSource = cred.TokenSource\n\t\topts = []option.ClientOption{\n\t\t\toption.WithUserAgent(userAgent),\n\t\t\toption.WithCredentials(cred),\n\t\t}\n\t}\n\n\tif endpoint != \"\" {\n\t\topts = append(opts, option.WithEndpoint(endpoint))\n\t}\n\tif quotaProject != \"\" {\n\t\topts = append(opts, option.WithQuotaProject(quotaProject))\n\t}\n\n\t// Initialize the high-level BigQuery client\n\tclient, err := bigqueryapi.NewClient(ctx, project, opts...)\n\tif err != nil {","sourceCodeStart":781,"sourceCodeEnd":817,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L781-L817","documentation":"This error is thrown when no impersonation service account is configured and the library falls back to Application Default Credentials, calling google.FindDefaultCredentials with the BigQuery/cloud-platform scopes. If no usable credential chain is found for those scopes (gcloud ADC file, GOOGLE_APPLICATION_CREDENTIALS, metadata server, etc.), the error is wrapped with the requested scopes. It is the standard 'no credentials available' failure from golang.org/x/oauth2/google.","triggerScenarios":"No impersonateServiceAccount is set, and google.FindDefaultCredentials(ctx, credScopes...) fails because GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no ~/.config/gcloud/application_default_credentials.json exists, and no GCE/GKE/Cloud Run metadata server is reachable.","commonSituations":"Running the toolbox locally without ever running 'gcloud auth application-default login'; GOOGLE_APPLICATION_CREDENTIALS set to a deleted or malformed key file; service account key JSON missing required scopes; deploying to an environment without an attached service account.","solutions":["Run 'gcloud auth application-default login' (with --scopes if needed) on local development machines.","Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account key JSON file.","Attach a service account with BigQuery access when running on GCP infrastructure.","Alternatively configure impersonateServiceAccount so the default-credential path is skipped.","Verify the credential file is valid JSON and readable."],"exampleFix":"// before\nexport GOOGLE_APPLICATION_CREDENTIALS=/old/path/key.json  // file deleted\n// after\ngcloud auth application-default login\n# or\nexport GOOGLE_APPLICATION_CREDENTIALS=$HOME/keys/bq-reader.json","handlingStrategy":"validation","validationCode":"// Validate ADC before starting the toolbox\nimport \"google.golang.org/api/option\"\nimport \"golang.org/x/oauth2/google\"\ncredScopes := []string{\"https://www.googleapis.com/auth/cloud-platform\"}\nif _, err := google.FindDefaultCredentials(context.Background(), credScopes...); err != nil {\n  return fmt.Errorf(\"ADC unavailable: %w — run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS\", err)\n}","typeGuard":null,"tryCatchPattern":"// Go\nif _, _, _, err := initBigQueryConnection(ctx, cfg); err != nil {\n  if strings.Contains(err.Error(), \"failed to find default Google Cloud credentials\") {\n    log.Fatalf(\"no ADC found: %v — run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS\", err)\n  }\n}","preventionTips":["Always run 'gcloud auth application-default login' in local dev environments.","Keep GOOGLE_APPLICATION_CREDENTIALS pointing at an existing, valid key file; check with a startup probe.","Attach a service account when deploying to GCP; avoid relying on fallback chains.","Validate credentials early at startup rather than at first query."],"tags":["bigquery","gcp","authentication","application-default-credentials","env-var"],"backgroundTag":"no-application-default-credentials","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}