google-gemini/gemini-cli · error · Error

Failed to get ADC ID token: ${e instanceof Error ? e.message

Error message

Failed to get ADC ID token: ${e instanceof Error ? e.message : String(e)}

What it means

For Cloud Run hosts the provider uses an ID token; if getIdTokenClient or fetchIdToken throws, the error is wrapped with 'Failed to get ADC ID token:' and the underlying message. Causes are environmental: ADC not set up, the audience rejected, metadata server unreachable, or the credentials lack permission to mint ID tokens for that audience.

Source

Thrown at packages/core/src/agents/auth-provider/google-credentials-provider.ts:116

      try {
        const idClient = await this.auth.getIdTokenClient(this.audience!);
        const idToken = await idClient.idTokenProvider.fetchIdToken(
          this.audience!,
        );

        const expiryTime = OAuthUtils.parseTokenExpiry(idToken);
        if (expiryTime) {
          this.tokenExpiryTime = expiryTime;
          this.cachedToken = idToken;
        }

        return { Authorization: `Bearer ${idToken}` };
      } catch (e) {
        const errorMessage = `Failed to get ADC ID token: ${
          e instanceof Error ? e.message : String(e)
        }`;
        debugLogger.error(errorMessage, e);
        throw new Error(errorMessage);
      }
    }

    // Otherwise, access token
    try {
      const client = await this.auth.getClient();
      const token = await client.getAccessToken();

      if (token.token) {
        this.cachedToken = token.token;
        // Use expiry_date from the underlying credentials if available.
        const creds = client.credentials;
        if (creds.expiry_date) {
          this.tokenExpiryTime = creds.expiry_date;
        }
        return { Authorization: `Bearer ${token.token}` };
      }
      throw new Error('Failed to retrieve ADC access token.');

View on GitHub (pinned to 5024443c72)

Solutions

Run `gcloud auth application-default login` on the dev machine.
In CI, configure Workload Identity Federation or set GOOGLE_APPLICATION_CREDENTIALS to a service-account key.
Confirm the audience (the Cloud Run host) corresponds to a deployed, reachable service.
Ensure the impersonated/service account has roles/iam.serviceAccountTokenCreator if cross-project.

Example fix

# before - no ADC on the machine
$ node app.js   # throws 'Failed to get ADC ID token'

# after
$ gcloud auth application-default login
$ node app.js

Defensive patterns

Strategy: retry

Try / catch

async function withTokenRetry(fn: () => Promise<HttpHeaders>, retries = 2): Promise<HttpHeaders> {
  for (let attempt = 0; ; attempt++) {
    try { return await fn(); }
    catch (e) {
      if (attempt >= retries || !/Failed to get ADC ID token/.test((e as Error).message)) throw e;
      await new Promise((r) => setTimeout(r, 500 * 2 ** attempt));
    }
  }
}

Prevention

Set up ADC before running: gcloud auth application-default login.
In CI, use Workload Identity Federation, not user logins.
Verify the service account can mint tokens for the audience.

When it happens

Trigger: No ADC configured locally (GOOGLE_APPLICATION_CREDENTIALS unset and no metadata server); running outside GCE/Cloud Run/Workload Identity without `gcloud auth application-default login`; the service account cannot mint tokens for the requested audience; the audience hostname does not match a deployed Cloud Run service.

Common situations: Developer machine without ADC; CI without Workload Identity Federation configured; pointing at a Cloud Run URL that was deleted; clock skew or metadata-server latency.

Related errors

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/92149c2119c3d697. Report an issue: GitHub.