calesthio/OpenMontage · error · RuntimeError

Service-account credentials did not yield a valid access tok

Error message

Service-account credentials did not yield a valid access token.

What it means

RuntimeError raised when a successful refresh leaves creds.token empty or non-string. It is a defensive guard after creds.refresh(Request()) — with well-formed google-auth versions the token is always populated, so hitting this usually indicates an unexpected credential subclass, an aborted refresh, or a google-auth version returning an odd token type.

Source

Thrown at tools/google_credentials.py:135

    if not path or not os.path.exists(path):
        raise RuntimeError(
            "GOOGLE_APPLICATION_CREDENTIALS is not set or points to a missing "
            "file; cannot use service-account authentication."
        )

    try:
        creds = service_account.Credentials.from_service_account_file(
            path, scopes=scopes
        )
        creds.refresh(Request())
    except Exception as exc:  # noqa: BLE001 - re-raised as actionable message
        raise RuntimeError(
            f"Failed to load/refresh service-account credentials from {path}: {exc}"
        ) from exc

    token = creds.token
    if not token or not isinstance(token, str):
        raise RuntimeError(
            "Service-account credentials did not yield a valid access token."
        )

    project_id = getattr(creds, "project_id", None)
    ret_project_id = str(project_id) if project_id is not None else None
    return token, ret_project_id

View on GitHub (pinned to 95e1c3d0ab)

Solutions

If in tests, make the fake Credentials set `token` to a string after refresh() is called.
Upgrade/pin google-auth to a current release (`pip install -U google-auth`) and retry.
If it persists with real keys, log type(creds) and creds.valid to confirm which credential class is in play and whether refresh actually succeeded.
Fall back to Application Default Credentials (gcloud auth application-default login) as an alternative auth path.

Example fix

# before (test fake)
class FakeCreds:
    def refresh(self, request): pass  # token never set -> RuntimeError

# after
class FakeCreds:
    def __init__(self):
        self.token = "fake-token"  # str token present after refresh
    def refresh(self, request): pass

Defensive patterns

Strategy: try-catch

Try / catch

try:
    token, project = get_service_account_token()
except RuntimeError as e:
    if "did not yield a valid access token" in str(e):
        token, project = get_adc_token_fallback()  # Application Default Credentials path
    else:
        raise

Prevention

In tests, make credential fakes set a string token after refresh().
Pin a current google-auth version; audit after any auth-library upgrade.
Have an ADC fallback auth path for resilience.

When it happens

Trigger: Extremely rare: a mocked/stubbed Credentials object in tests, a google-auth version regression, or custom credential classes where .token is not set post-refresh. Standard service-account flows practically never produce it.

Common situations: Unit tests monkeypatching google.oauth2.service_account.Credentials with fakes that skip token assignment; downgrading/pinning an unusual google-auth version.

Related errors

AI-assisted analysis of calesthio/OpenMontage@95e1c3d0ab (2026-08-15). Data as JSON: /api/errors/d984e3b1b051e5cc. Report an issue: GitHub.