{"record":{"id":"e77f84f67e600479","repo":"prestodb/presto","slug":"failed-to-create-credentials-from-key","errorCode":null,"errorMessage":"Failed to create Credentials from key","messagePattern":"Failed to create Credentials from key","errorType":"exception","errorClass":"UncheckedIOException","httpStatus":null,"severity":"error","filePath":"presto-bigquery/src/main/java/com/facebook/presto/plugin/bigquery/BigQueryCredentialsSupplier.java","lineNumber":52,"sourceCode":"    public BigQueryCredentialsSupplier(Optional<String> credentialsKey, Optional<String> credentialsFile)\n    {\n        // lazy creation, cache once it's created\n        this.credentialsCreator = Suppliers.memoize(() -> {\n            Optional<Credentials> credentialsFromKey = credentialsKey.map(BigQueryCredentialsSupplier::createCredentialsFromKey);\n            Optional<Credentials> credentialsFromFile = credentialsFile.map(BigQueryCredentialsSupplier::createCredentialsFromFile);\n            return Stream.of(credentialsFromKey, credentialsFromFile)\n                    .flatMap(Streams::stream)\n                    .findFirst();\n        });\n    }\n\n    private static Credentials createCredentialsFromKey(String key)\n    {\n        try {\n            return GoogleCredentials.fromStream(new ByteArrayInputStream(Base64.decodeBase64(key)));\n        }\n        catch (IOException e) {\n            throw new UncheckedIOException(\"Failed to create Credentials from key\", e);\n        }\n    }\n\n    private static Credentials createCredentialsFromFile(String file)\n    {\n        try {\n            return GoogleCredentials.fromStream(new FileInputStream(file));\n        }\n        catch (IOException e) {\n            throw new UncheckedIOException(\"Failed to create Credentials from file\", e);\n        }\n    }\n\n    Optional<Credentials> getCredentials()\n    {\n        return credentialsCreator.get();\n    }\n}","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-bigquery/src/main/java/com/facebook/presto/plugin/bigquery/BigQueryCredentialsSupplier.java#L34-L70","documentation":"BigQueryCredentialsSupplier decodes a base64 service-account key and parses it into Google Credentials via GoogleCredentials.fromStream. If parsing fails with an IOException (malformed JSON, not a valid key, or invalid base64 producing garbage), it throws UncheckedIOException with 'Failed to create Credentials from key'. This is a credential configuration problem, not a network issue.","triggerScenarios":"Configuring bigquery.credentials-key with a value that is not valid base64 or not a valid service-account JSON/P12 key file content; e.g. passing the raw JSON file path instead of the base64 of the file, or a truncated/copied-wrongly key.","commonSituations":"Copy-pasting the JSON key itself instead of base64-encoding the key file; expired/deleted service account key; using the wrong property (key vs key-file) so a path string gets base64-decoded; whitespace/newlines corrupting the encoded value.","solutions":["Verify the key: base64 -w0 service-account.json and put that single-line output into bigquery.credentials-key","Alternatively use bigquery.credentials-key-file pointing directly to the JSON key file to avoid encoding issues","Confirm the key file is a valid service-account JSON (try gcloud auth activate-service-account --key-file=...)","Re-create the key in GCP console if the file is truncated or the key was deleted"],"exampleFix":"// before\ncredentials-key=eyJ...<truncated or raw JSON>\n// after\nbase64 -w0 sa-key.json  # then use that output\ncredentials-key=<full valid base64 of sa-key.json>","handlingStrategy":"validation","validationCode":"// Validate the base64 key before configuring:\nimport org.apache.commons.codec.binary.Base64;\nString decoded = new String(Base64.decodeBase64(key), StandardCharsets.UTF_8);\nif (!decoded.trim().startsWith(\"{\")) {\n    throw new IllegalArgumentException(\"credentials-key must be base64 of a service-account JSON file\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Supplier<Credentials> supplier = ...; // build BigQueryCredentialsSupplier\n} catch (UncheckedIOException e) {\n    if (e.getMessage().contains(\"Failed to create Credentials from key\")) {\n        // fix bigquery.credentials-key: re-encode the key file with `base64 -w0 key.json`\n    } else {\n        throw e;\n    }\n}","preventionTips":["Always base64-encode the whole key file (base64 -w0 service-account.json) — do not paste raw JSON","Prefer bigquery.credentials-key-file to point at the JSON file directly","Confirm the key file parses: gcloud auth activate-service-account --key-file=key.json","Guard against copy-paste corruption: keep the key as a single line and verify length before deploying"],"tags":["bigquery","authentication","credentials","configuration"],"backgroundTag":"invalid-credentials-key","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}