{"record":{"id":"f4a8383ccbbf8d33","repo":"apache/beam","slug":"unable-to-get-application-default-credentials-please-see","errorCode":null,"errorMessage":"Unable to get application default credentials. Please see https://developers.google.com/accounts/docs/application-default-credentials for details on how to specify credentials. This version of the SDK is dependent on the gcloud core component version 2015.02.05 or newer to be able to get credentials from the currently authorized user via gcloud auth.","messagePattern":"Unable to get application default credentials\\. Please see https://developers\\.google\\.com/accounts/docs/application-default-credentials for details on how to specify credentials\\. This version of the SDK is dependent on the gcloud core component version 2015\\.02\\.05 or newer to be able to get credentials from the currently authorized user via gcloud auth\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":401,"severity":"critical","filePath":"sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/auth/NullCredentialInitializer.java","lineNumber":60,"sourceCode":"    httpRequest.setUnsuccessfulResponseHandler(new NullCredentialHttpUnsuccessfulResponseHandler());\n  }\n\n  private static class NullCredentialHttpUnsuccessfulResponseHandler\n      implements HttpUnsuccessfulResponseHandler {\n\n    @Override\n    public boolean handleResponse(\n        HttpRequest httpRequest, HttpResponse httpResponse, boolean supportsRetry)\n        throws IOException {\n      if (!httpResponse.isSuccessStatusCode() && httpResponse.getStatusCode() == ACCESS_DENIED) {\n        throwNullCredentialException();\n      }\n      return supportsRetry;\n    }\n  }\n\n  public static void throwNullCredentialException() {\n    throw new RuntimeException(NULL_CREDENTIAL_REASON);\n  }\n}\n","sourceCodeStart":42,"sourceCodeEnd":63,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/extensions/google-cloud-platform-core/src/main/java/org/apache/beam/sdk/extensions/gcp/auth/NullCredentialInitializer.java#L42-L63","documentation":"NullCredentialInitializer.throwNullCredentialException throws a RuntimeException when the Google Cloud client library could not obtain Application Default Credentials (credential is null). The message directs users to set up ADC, noting that gcloud core component 2015.02.05+ is needed for 'gcloud auth' based credentials.","triggerScenarios":"Calling Google Cloud APIs via Beam (GCS, BigQuery, Dataflow) when no credential can be resolved: GOOGLE_APPLICATION_CREDENTIALS unset, no gcloud auth application-default login done, and no metadata-server credentials available (e.g. running locally outside GCP).","commonSituations":"Running a Beam pipeline locally without authenticating; CI containers lacking service-account keys; stale gcloud installations predating the required version.","solutions":["Run `gcloud auth application-default login` on the local machine","Set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON key file path","Pass credentials explicitly via pipeline options (e.g. --serviceAccount or a Credentials provider)","Update the gcloud SDK to at least the required component version","Verify the code runs on an environment with a metadata server (GCE/GKE/Cloud Run) if relying on ambient credentials"],"exampleFix":"// before\n$ mvn exec:java ... # no credentials configured -> RuntimeException\n// after\n$ gcloud auth application-default login\n$ export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json","handlingStrategy":"try-catch","validationCode":"try { GoogleCredentials.getApplicationDefault(); } catch (IOException e) { throw new IllegalStateException(\"ADC not configured: run gcloud auth application-default login or set GOOGLE_APPLICATION_CREDENTIALS\"); }","typeGuard":"boolean adcAvailable() { try { GoogleCredentials.getApplicationDefault(); return true; } catch (IOException e) { return false; } }","tryCatchPattern":"try { runPipeline(options); } catch (RuntimeException e) { if (e.getMessage() != null && e.getMessage().contains(\"Unable to get application default credentials\")) { /* prompt ADC setup */ } else throw e; }","preventionTips":["Set GOOGLE_APPLICATION_CREDENTIALS in CI/local environments","Run gcloud auth application-default login before local runs","Use a service account key or explicit credentials provider in options","Keep gcloud components up to date"],"tags":["authentication","gcp","credentials","beam"],"backgroundTag":"missing-credentials","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}