google-gemini/gemini-cli · error · Error

Failed to get ADC access token: ${e instanceof Error ? e.mes

Error message

Failed to get ADC access token: ${e instanceof Error ? e.message : String(e)}

What it means

The outer catch on the access-token path: getClient or getAccessToken threw an Error, and it is wrapped as 'Failed to get ADC access token: <message>'. Unlike 195 (which fires when a token object exists but is empty), this fires when the call itself rejects. The underlying message usually names the precise failure (invalid_grant, no credentials found, network).

Source

Thrown at packages/core/src/agents/auth-provider/google-credentials-provider.ts:140

      const client = await this.auth.getClient();
      const token = await client.getAccessToken();

      if (token.token) {
        this.cachedToken = token.token;
        // Use expiry_date from the underlying credentials if available.
        const creds = client.credentials;
        if (creds.expiry_date) {
          this.tokenExpiryTime = creds.expiry_date;
        }
        return { Authorization: `Bearer ${token.token}` };
      }
      throw new Error('Failed to retrieve ADC access token.');
    } catch (e) {
      const errorMessage = `Failed to get ADC access token: ${
        e instanceof Error ? e.message : String(e)
      }`;
      debugLogger.error(errorMessage, e);
      throw new Error(errorMessage);
    }
  }

  override async shouldRetryWithHeaders(
    _req: RequestInit,
    res: Response,
  ): Promise<HttpHeaders | undefined> {
    if (res.status !== 401 && res.status !== 403) {
      this.authRetryCount = 0;
      return undefined;
    }

    if (this.authRetryCount >= BaseA2AAuthProvider.MAX_AUTH_RETRIES) {
      return undefined;
    }
    this.authRetryCount++;

    debugLogger.debug(

View on GitHub (pinned to 5024443c72)

Solutions

1. Set up ADC: `gcloud auth application-default login` (dev) or Workload Identity Federation (CI/prod).
2. Read the inner message to distinguish 'no credentials' from 'invalid_grant'.
3. For invalid_grant, re-login or rotate the service-account key.
4. Ensure the runtime can reach the GCE metadata server if running on GCE.

Example fix

# before - no ADC
$ node app.js   # 'Failed to get ADC access token: Could not load the default credentials.'

# after
$ gcloud auth application-default login
$ node app.js

try {
  return await provider.headers();
} catch (e) {
  const msg = (e as Error).message;
  if (/Could not load the default credentials/.test(msg)) {
    throw new Error('ADC is not configured. Run `gcloud auth application-default login`.');
  }
  if (/invalid_grant/.test(msg)) {
    throw new Error('ADC token expired or revoked. Re-login required.');
  }
  throw e;
}

When it happens

Trigger: No ADC configured at all (google-auth-library throws 'Could not load the default credentials'); a refresh-token grant failed with invalid_grant; the metadata server is unreachable from the runtime; the credential JSON is malformed.

Common situations: First run on a new machine/container without ADC; a long-lived key whose refresh expired; a sandboxed runtime that blocks the metadata server (169.254.169.254); corrupted credentials JSON.

Related errors

• Failed to retrieve ADC access token.
• Failed to get ADC ID token: ${e instanceof Error ? e.message
• Protocol "${urlObj.protocol}" is not secure. Google Credenti
• Host "${hostname}" is not an allowed host for Google Credent
• Environment variable '${envVar}' is not set or is empty. Ple

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/89af8b89993f629f. Report an issue: GitHub.