{"record":{"id":"f8a4242f09e92555","repo":"openai/openai-python","slug":"failed-to-fetch-gcp-subject-token-from-metadata-se","errorCode":null,"errorMessage":"Failed to fetch GCP subject token from metadata server: HTTP {response.status_code}","messagePattern":"Failed to fetch GCP subject token from metadata server: HTTP (.+?)","errorType":"http","errorClass":"SubjectTokenProviderError","httpStatus":null,"severity":"critical","filePath":"src/openai/auth/_workload.py","lineNumber":193,"sourceCode":"        audience: the unique URI agreed upon by both the instance and the system verifying\n            the instance's identity. Defaults to `https://api.openai.com/v1`.\n        timeout: the request timeout in seconds. Defaults to 10.0.\n        http_client: optional httpx2.Client instance to use for requests. If not provided, a new client will be created for each request.\n    \"\"\"\n\n    def get_token() -> str:\n        try:\n            url = \"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity\"\n            params = {\"audience\": audience}\n\n            if http_client is not None:\n                response = http_client.get(url, params=params, headers={\"Metadata-Flavor\": \"Google\"}, timeout=timeout)\n            else:\n                with httpx2.Client() as client:\n                    response = client.get(url, params=params, headers={\"Metadata-Flavor\": \"Google\"}, timeout=timeout)\n\n            if response.is_error:\n                raise SubjectTokenProviderError(\n                    f\"Failed to fetch GCP subject token from metadata server: HTTP {response.status_code}\",\n                    response=response,\n                )\n            token = response.text.strip()\n            if not token:\n                raise SubjectTokenProviderError(\"GCP metadata server returned an empty token\", response=response)\n            return token\n        except Exception as e:\n            raise SubjectTokenProviderError(f\"Failed to fetch GCP subject token from metadata server: {e}\") from e\n\n    return {\"token_type\": \"id\", \"get_token\": get_token}\n\n\nclass _WorkloadIdentityAuth(Generic[_WorkloadIdentityT]):\n    def __init__(\n        self,\n        *,\n        workload_identity: _WorkloadIdentityT,","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/auth/_workload.py#L175-L211","documentation":"The GCP identity-token provider requests a token from the Compute Engine metadata server (metadata.google.internal) with the Metadata-Flavor: Google header. An HTTP error status triggers this SubjectTokenProviderError with the status code attached. Typical causes: 404 when the metadata endpoint path or query is wrong, 403/401 from GCE firewall blocks on metadata requests, or 503 during metadata server restarts.","triggerScenarios":"Running with gcp_id_token_provider on GCE/Cloud Run/GKE where the metadata server responds with an error: wrong audience/resource parameters, metadata server blocked by organization policy, or the instance's metadata server restarting.","commonSituations":"Query-string parameters (audience) misconfigured for the target API; GKE Workload Identity sidecar not ready at startup; org policies blocking legacy metadata endpoints; startup races before the metadata agent is available.","solutions":["Retry with backoff on 5xx/503 — metadata server restarts are transient","Verify the request from the same host: curl -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=...'","Check the audience matches the API you're authenticating to","Ensure the service account has the roles/permissions needed for the target API"],"exampleFix":"# before\nprovider = gcp_id_token_provider(audience=\"https://wrong.api/\")\n\n# after\nprovider = gcp_id_token_provider(audience=\"https://api.openai.com/v1\")","handlingStrategy":"retry","validationCode":"import httpx\nr = httpx.get(META_URL, headers={\"Metadata-Flavor\":\"Google\"})\nassert not r.is_error, r.status_code","typeGuard":null,"tryCatchPattern":"for attempt in range(3):\n    try:\n        return provider_get_token()\n    except SubjectTokenProviderError as e:\n        if \"HTTP 5\" in str(e): time.sleep(2**attempt); continue\n        raise","preventionTips":["Retry transient metadata server 5xx","Verify audience parameter matches the target API","Wait for GKE metadata agent readiness at startup"],"tags":["gcp","metadata-server","auth","cloud-identity"],"backgroundTag":"metadata-server-auth-failed","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}