google-gemini/gemini-cli · critical · FatalAuthenticationError

COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallba

Error message

COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallback skipped due to ${reason}. Run in an interactive terminal to use OAuth.)

What it means

FatalAuthenticationError thrown by refreshAuthentication when USE_CCPA is set, the COMPUTE_ADC auth attempt failed, AND the LOGIN_WITH_GOOGLE OAuth fallback is intentionally skipped because either isHeadlessMode() is true or GEMINI_CLI_USE_COMPUTE_ADC=true was explicitly set. The message bundles the ADC failure reason and tells the user OAuth needs an interactive terminal.

Source

Thrown at packages/a2a-server/src/config/config.ts:622

    try {
      await config.refreshAuth(AuthType.COMPUTE_ADC);
      logger.info(`[${logPrefix}] COMPUTE_ADC successful.`);
    } catch (adcError) {
      const adcMessage =
        adcError instanceof Error ? adcError.message : String(adcError);
      logger.info(
        `[${logPrefix}] COMPUTE_ADC failed or not available: ${adcMessage}`,
      );

      const useComputeAdc =
        getEnvLocal('GEMINI_CLI_USE_COMPUTE_ADC') === 'true';
      const isHeadless = isHeadlessMode();

      if (isHeadless || useComputeAdc) {
        const reason = isHeadless
          ? 'headless mode'
          : 'GEMINI_CLI_USE_COMPUTE_ADC=true';
        throw new FatalAuthenticationError(
          `COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallback skipped due to ${reason}. Run in an interactive terminal to use OAuth.)`,
        );
      }

      logger.info(
        `[${logPrefix}] COMPUTE_ADC failed, falling back to LOGIN_WITH_GOOGLE.`,
      );
      try {
        await config.refreshAuth(AuthType.LOGIN_WITH_GOOGLE);
      } catch (e) {
        if (e instanceof FatalAuthenticationError) {
          const originalMessage = e instanceof Error ? e.message : String(e);
          throw new FatalAuthenticationError(
            `${originalMessage}. The initial COMPUTE_ADC attempt also failed: ${adcMessage}`,
          );
        }
        throw e;
      }

View on GitHub (pinned to 5024443c72)

Solutions

Provide valid compute credentials: set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON key, or run on a Compute Engine VM with the right scope.
For local/interactive use, unset GEMINI_CLI_USE_COMPUTE_ADC and run in a real terminal so the LOGIN_WITH_GOOGLE browser fallback can run.
Alternatively switch to GEMINI_API_KEY auth (unset USE_CCPA, set GEMINI_API_KEY).
Refresh the service-account key if it expired.

Example fix

# before
export USE_CCPA=true
# headless CI -> COMPUTE_ADC fails, OAuth skipped, FatalAuthenticationError

# after (option A: service account)
export USE_CCPA=true
export GOOGLE_APPLICATION_CREDENTIALS=/secrets/sa-key.json

# after (option B: API key)
unset USE_CCPA
export GEMINI_API_KEY=...

Defensive patterns

Strategy: validation

Validate before calling

function authReadyForHeadlessCcpa(env: NodeJS.ProcessEnv): boolean {
  if (env['USE_CCPA'] !== 'true') return true; // not applicable
  // In headless, compute ADC must work without OAuth fallback
  return !!env['GOOGLE_APPLICATION_CREDENTIALS'] || hasGceMetadataServer();
}

Try / catch

try {
  await refreshAuthentication(config, logPrefix, envVars);
} catch (e) {
  if (e instanceof FatalAuthenticationError && e.message.includes('COMPUTE_ADC failed')) {
    // surface actionable guidance, fall back to API key
    logger.error('CCPA ADC failed; set GEMINI_API_KEY as fallback.');
  }
  throw e;
}

Prevention

In CI/containers, set GOOGLE_APPLICATION_CREDENTIALS to a service-account key.
Unset GEMINI_CLI_USE_COMPUTE_ADC in environments that should fall back to OAuth.
Run auth setup interactively once, then copy the cached credentials into the image.
Keep an API-key fallback (GEMINI_API_KEY) configured for headless deployments.

When it happens

Trigger: Running the server in a headless/CI/container environment with USE_CCPA set but no valid compute credentials (no metadata server, no service account), so COMPUTE_ADC fails and the headless guard suppresses the browser OAuth fallback. Also when GEMINI_CLI_USE_COMPUTE_ADC=true forces compute-only auth and ADC is unavailable.

Common situations: CI pipeline without GOOGLE_APPLICATION_CREDENTIALS; container lacking the Compute Engine metadata server; developer who set GEMINI_CLI_USE_COMPUTE_ADC=true on a workstation without a service account; expired service-account key.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/1e64f65ba777e033. Report an issue: GitHub.