{"record":{"id":"db7840652bac066d","repo":"kubernetes/kops","slug":"error-fetching-oauth2-token-info-v","errorCode":null,"errorMessage":"error fetching oauth2 token info: %v","messagePattern":"error fetching oauth2 token info: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gce/gce_cloud.go","lineNumber":420,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building token source: %v\", err)\n\t}\n\n\ttoken, err := tokenSource.Token()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting token: %v\", err)\n\t}\n\n\t// Note: do not log token or any portion of it\n\n\tservice, err := oauth2.NewService(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating oauth2 service: %v\", err)\n\t}\n\n\ttokenInfo, err := service.Tokeninfo().AccessToken(token.AccessToken).Do()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error fetching oauth2 token info: %v\", err)\n\t}\n\n\treturn tokenInfo, nil\n}\n\n// SplitServiceAccountEmail splits service account email\nfunc SplitServiceAccountEmail(email string) (string, string, error) {\n\taccountID := \"\"\n\tprojectID := \"\"\n\n\ttokens := strings.Split(email, \"@\")\n\tif len(tokens) == 2 {\n\t\taccountID = tokens[0]\n\t\tif strings.HasSuffix(tokens[1], \".iam.gserviceaccount.com\") {\n\t\t\tprojectID = strings.TrimSuffix(tokens[1], \".iam.gserviceaccount.com\")\n\t\t}\n\t}\n","sourceCodeStart":402,"sourceCodeEnd":438,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gce/gce_cloud.go#L402-L438","documentation":"Wraps the Tokeninfo API call failure in getTokenInfo: the access token was obtained, but querying its metadata via oauth2 Tokeninfo failed — invalid token, API errors, or connectivity. Purely diagnostic path, but treated as a hard error at this site.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:420 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the token is valid (re-auth if revoked)","Check connectivity to the OAuth2 API","Inspect the wrapped error"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}