{"record":{"id":"ef7a547458024ead","repo":"grpc/grpc-go","slug":"failed-to-build-call-credentials-from-bootstrap-fo","errorCode":null,"errorMessage":"failed to build call credentials from bootstrap for %q: %v","messagePattern":"failed to build call credentials from bootstrap for %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/xds/bootstrap/bootstrap.go","lineNumber":391,"sourceCode":"\t\t\tsc.extraDialOptions = d.DialOptions()\n\t\t}\n\t\tsc.cleanups = append(sc.cleanups, cancel)\n\t\tbreak\n\t}\n\n\tif envconfig.XDSBootstrapCallCredsEnabled {\n\t\t// Process call credentials - unlike channel creds, we use ALL supported\n\t\t// types. Also, call credentials are optional as per gRFC A97.\n\t\tfor _, cfg := range server.CallCredsConfigs {\n\t\t\tc := bootstrap.GetCallCredentials(cfg.Type)\n\t\t\tif c == nil {\n\t\t\t\t// Skip unsupported call credential types (don't fail bootstrap).\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tcallCreds, cancel, err := c.Build(cfg.Config)\n\t\t\tif err != nil {\n\t\t\t\t// Call credential validation failed - this should fail bootstrap.\n\t\t\t\treturn fmt.Errorf(\"failed to build call credentials from bootstrap for %q: %v\", cfg.Type, err)\n\t\t\t}\n\t\t\tsc.selectedCallCreds = append(sc.selectedCallCreds, callCreds)\n\t\t\tsc.extraDialOptions = append(sc.extraDialOptions, grpc.WithPerRPCCredentials(callCreds))\n\t\t\tsc.cleanups = append(sc.cleanups, cancel)\n\t\t}\n\t}\n\n\tif sc.serverURI == \"\" {\n\t\treturn fmt.Errorf(\"xds: `server_uri` field in server config cannot be empty: %s\", string(data))\n\t}\n\tif sc.credsDialOption == nil {\n\t\treturn fmt.Errorf(\"xds: `channel_creds` field in server config cannot be empty: %s\", string(data))\n\t}\n\treturn nil\n}\n\n// ServerConfigTestingOptions specifies options for creating a new ServerConfig\n// for testing purposes.","sourceCodeStart":373,"sourceCodeEnd":409,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/bootstrap/bootstrap.go#L373-L409","documentation":"Returned by ServerConfig.UnmarshalJSON (internal/xds/bootstrap/bootstrap.go:390) when building a call-credentials configuration fails. This path only runs when GRPC_XDS_BOOTSTRAP_CALL_CREDS (envconfig.XDSBootstrapCallCredsEnabled) is enabled; for each supported call-creds type, Build() is invoked and the first failure is fatal.","triggerScenarios":"XDSBootstrapCallCredsEnabled is true and a `call_creds` entry of a supported type fails to build — e.g. a token-file/OAuth creds plugin that cannot read its source, or a service-account config that is invalid.","commonSituations":"Enabling call creds for the management server but pointing at an unreadable token file; ADC unavailable for the call-creds type; plugin config schema mismatch.","solutions":["Read the wrapped error (%v) to see why the call-creds Build failed","Fix the call_creds config (correct token path, valid ADC, right plugin config)","Disable GRPC_XDS_BOOTSTRAP_CALL_CREDS if call creds to the management server are not required"],"exampleFix":"// before: token file creds type with bad path\n{\"call_creds\":[{\"type\":\"token_file\",\"config\":{\"token_path\":\"/missing/token\"}}]}\n// after\n{\"call_creds\":[{\"type\":\"token_file\",\"config\":{\"token_path\":\"/etc/secrets/xds.token\"}}]}","handlingStrategy":"validation","validationCode":"// If call creds are enabled, verify their sources resolve first.\nif os.Getenv(\"GRPC_XDS_BOOTSTRAP_CALL_CREDS\") != \"\" {\n    for _, cc := range serverCallCreds {\n        if cc.Type == \"token_file\" {\n            var cfg struct{ Path string `json:\"token_path\"` }\n            _ = json.Unmarshal(cc.Config, &cfg)\n            if _, err := os.Stat(cfg.Path); err != nil { return err }\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"cfg, err := bootstrap.NewConfigFromContents(data)\nif err != nil {\n    if strings.Contains(err.Error(), \"call credentials\") {\n        log.Fatalf(\"bootstrap call creds failed to build: %v\", err)\n    }\n}","preventionTips":["Only enable GRPC_XDS_BOOTSTRAP_CALL_CREDS when call creds are required","Ensure token files / ADC exist in the deployment","Register any custom call-creds plugins"],"tags":["grpc","xds","bootstrap","credentials","call-creds","config","go"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}