{"record":{"id":"fcd47fb482f04af7","repo":"calesthio/OpenMontage","slug":"service-account-auth-requires-the-google-auth-pa","errorCode":null,"errorMessage":"Service-account auth requires the 'google-auth' package. Install it with: pip install google-auth","messagePattern":"Service-account auth requires the 'google-auth' package\\. Install it with: pip install google-auth","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"tools/google_credentials.py","lineNumber":111,"sourceCode":"\ndef get_access_token(scopes: list[str] | None = None) -> tuple[str, str | None]:\n    \"\"\"Mint an OAuth access token from the service-account JSON.\n\n    Returns ``(access_token, project_id)``. ``project_id`` is the one embedded\n    in the key file (callers should still prefer :func:`resolve_project_id`).\n\n    Raises:\n        RuntimeError: if ``google-auth`` is missing or the credentials cannot\n            be loaded/refreshed — with a message the agent can surface verbatim.\n    \"\"\"\n    if scopes is None:\n        scopes = [CLOUD_PLATFORM_SCOPE]\n\n    try:\n        from google.auth.transport.requests import Request\n        from google.oauth2 import service_account\n    except ImportError as exc:  # pragma: no cover - depends on optional dep\n        raise RuntimeError(\n            \"Service-account auth requires the 'google-auth' package. \"\n            \"Install it with: pip install google-auth\"\n        ) from exc\n\n    path = os.environ.get(\"GOOGLE_APPLICATION_CREDENTIALS\")\n    if not path or not os.path.exists(path):\n        raise RuntimeError(\n            \"GOOGLE_APPLICATION_CREDENTIALS is not set or points to a missing \"\n            \"file; cannot use service-account authentication.\"\n        )\n\n    try:\n        creds = service_account.Credentials.from_service_account_file(\n            path, scopes=scopes\n        )\n        creds.refresh(Request())\n    except Exception as exc:  # noqa: BLE001 - re-raised as actionable message\n        raise RuntimeError(","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/calesthio/OpenMontage/blob/95e1c3d0ab93482159818560f6a8c8e866b9139f/tools/google_credentials.py#L93-L129","documentation":"RuntimeError raised by the service-account auth helper when the optional google-auth package cannot be imported. The project treats Google auth as an optional dependency, so the import sits inside the function and ImportError is converted into an installable-instruction message surfaced verbatim to the agent/user.","triggerScenarios":"Calling the service-account token function (get service-account credentials for Google/Gemini scopes) in an environment where `pip install google-auth` was never run, or where google-auth is shadowed by a conflicting package on sys.path.","commonSituations":"Deployments that installed only google-generativeai or google-genai (which do not always pull google-auth), slim Docker images, multiple virtualenvs, or a local `google/` directory shadowing the installed package.","solutions":["Install it: `pip install google-auth` (plus `google-auth-oauthlib`/`requests` if other flows need them).","Verify with the same interpreter: `python -c \"from google.oauth2 import service_account; print('ok')\"`.","If still failing despite installation, check for a local file/directory named `google.py` or `google/` in the project root shadowing the package; rename it.","Add google-auth to the project's locked requirements so environments are reproducible."],"exampleFix":"# before\nRuntimeError: Service-account auth requires the 'google-auth' package.\n\n# after (requirements.txt)\ngoogle-auth>=2.0","handlingStrategy":"validation","validationCode":"def google_auth_available() -> bool:\n    try:\n        from google.oauth2 import service_account  # noqa: F401\n        return True\n    except ImportError:\n        return False","typeGuard":null,"tryCatchPattern":"try:\n    token, project = get_service_account_token()\nexcept RuntimeError as e:\n    if \"google-auth\" in str(e):\n        subprocess.run([sys.executable, \"-m\", \"pip\", \"install\", \"google-auth\"], check=True)\n        token, project = get_service_account_token()  # retry once\n    else:\n        raise","preventionTips":["Include google-auth in deployment requirements from day one.","Run an import smoke test for optional deps at service startup.","Avoid local modules named google.py/google/ that shadow the package."],"tags":["google","authentication","dependency","service-account"],"backgroundTag":null,"analyzedSha":"95e1c3d0ab93482159818560f6a8c8e866b9139f","analyzedAt":"2026-08-15T06:31:20.014Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}