google-gemini/gemini-cli · error · Error

Could not authenticate using metadata server application def

Error message

Could not authenticate using metadata server application default credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ${getErrorMessage(e)}

What it means

Thrown during OAuth2 authentication when AuthType.COMPUTE_ADC is selected but the Google Compute metadata server fails to return an access token. The code creates a Compute client from google-auth-library (which reads the GCE metadata server at 169.254.169.254) and calls getAccessToken(). If the metadata server is unreachable or returns an error, the raw error is wrapped into a descriptive message. This auth type only works inside GCE, Cloud Shell, Cloud Run, or GKE.

Source

Thrown at packages/core/src/code_assist/oauth2.ts:252

  // use Application Default Credentials (ADC) provided via its metadata server
  // to authenticate non-interactively using the identity of the logged-in user.
  if (authType === AuthType.COMPUTE_ADC) {
    try {
      debugLogger.log(
        'Attempting to authenticate via metadata server application default credentials.',
      );

      const computeClient = new Compute({
        // We can leave this empty, since the metadata server will provide
        // the service account email.
      });
      await computeClient.getAccessToken();
      debugLogger.log('Authentication successful.');

      // Do not cache creds in this case; note that Compute client will handle its own refresh
      return computeClient;
    } catch (e) {
      throw new Error(
        `Could not authenticate using metadata server application default credentials. Please select a different authentication method or ensure you are in a properly configured environment. Error: ${getErrorMessage(
          e,
        )}`,
      );
    }
  }

  if (config.isBrowserLaunchSuppressed()) {
    if (!config.isInteractive()) {
      throw new FatalAuthenticationError(
        'Manual authorization is required but the current session is non-interactive. ' +
          'Please run the Gemini CLI in an interactive terminal to log in, ' +
          'provide a GEMINI_API_KEY, or ensure Application Default Credentials are configured.',
      );
    }
    let success = false;
    const maxRetries = 2;
    // Enter alternate buffer

View on GitHub (pinned to 5024443c72)

Solutions

1. Confirm you are actually running inside a GCE environment (GCE, Cloud Shell, Cloud Run, GKE).
2. Verify the instance has a service account attached with the required scopes.
3. If not in GCE, switch to LOGIN_WITH_GOOGLE or set GEMINI_API_KEY.
4. Check network/firewall rules allow access to 169.254.169.254.
5. If on Cloud Shell, restart the session or recreate the instance.

// Detect GCE environment before attempting COMPUTE_ADC
async function isGCE(): Promise<boolean> {
  try {
    const res = await fetch('http://169.254.169.254/computeMetadata/v1/', {
      headers: { 'Metadata-Flavor': 'Google' },
      signal: AbortSignal.timeout(1000),
    });
    return res.headers.get('Metadata-Flavor') === 'Google';
  } catch {
    return false;
  }
}

if (authType === AuthType.COMPUTE_ADC && !(await isGCE())) {
  throw new Error('COMPUTE_ADC selected but not running on GCE.');
}

try {
  client = await getOauthClient(AuthType.COMPUTE_ADC, config);
} catch (e) {
  if (e instanceof Error && e.message.includes('metadata server application default credentials')) {
    // Fall back to interactive OAuth or API key
    client = await getOauthClient(AuthType.LOGIN_WITH_GOOGLE, config);
  } else throw e;
}

When it happens

Trigger: AuthType.COMPUTE_ADC is resolved (e.g., because the environment looks like GCE or it was explicitly configured) but computeClient.getAccessToken() throws. The Compute client queries the metadata server at 169.254.169.254; failure means the server is unreachable, the instance has no service account, or a network firewall blocks the metadata endpoint.

Common situations: Running outside GCE but COMPUTE_ADC was forced via config; the GCE instance has no attached service account; a firewall rule or proxy blocks 169.254.169.254; running in a container that doesn't inherit the host's metadata network; Cloud Shell session expired or is in a degraded state; VPC-SC policies block the metadata request.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ${originalMessage}. The initial COMPUTE_ADC attempt also fai
• Failed to load OAuth credentials
• Manual authorization is required but the current session is
• Failed to open browser: ${getErrorMessage(err)}
• COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallba

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/336ffe0a79c8416f. Report an issue: GitHub.