google-gemini/gemini-cli · error · Error

Failed to retrieve ADC access token.

Error message

Failed to retrieve ADC access token.

What it means

On the access-token path, getClient + getAccessToken succeeded but returned a falsy token.token. This is unusual: ADC found credentials but could not produce a bearer token. The message is thrown directly (not wrapped) and is then caught by the surrounding try/catch and re-thrown with the access-token prefix, but this specific string signals an empty token result.

Source

Thrown at packages/core/src/agents/auth-provider/google-credentials-provider.ts:134

        throw new Error(errorMessage);
      }
    }

    // Otherwise, access token
    try {
      const client = await this.auth.getClient();
      const token = await client.getAccessToken();

      if (token.token) {
        this.cachedToken = token.token;
        // Use expiry_date from the underlying credentials if available.
        const creds = client.credentials;
        if (creds.expiry_date) {
          this.tokenExpiryTime = creds.expiry_date;
        }
        return { Authorization: `Bearer ${token.token}` };
      }
      throw new Error('Failed to retrieve ADC access token.');
    } catch (e) {
      const errorMessage = `Failed to get ADC access token: ${
        e instanceof Error ? e.message : String(e)
      }`;
      debugLogger.error(errorMessage, e);
      throw new Error(errorMessage);
    }
  }

  override async shouldRetryWithHeaders(
    _req: RequestInit,
    res: Response,
  ): Promise<HttpHeaders | undefined> {
    if (res.status !== 401 && res.status !== 403) {
      this.authRetryCount = 0;
      return undefined;
    }

View on GitHub (pinned to 5024443c72)

Solutions

1. Re-run `gcloud auth application-default login` to refresh local ADC.
2. If using a key file, regenerate the service-account key.
3. For Workload Identity Federation, verify the credential source token is still valid.
4. Retry once; transient empty metadata responses do occur.

Example fix

# before - stale ADC yields no token
$ node app.js   # 'Failed to retrieve ADC access token.'

# after
$ gcloud auth application-default login
$ node app.js

try {
  return await provider.headers();
} catch (e) {
  if (/Failed to retrieve ADC access token\.$/.test((e as Error).message)) {
    // empty token result - refresh ADC and retry once
    await refreshAdc();
    return provider.headers();
  }
  throw e;
}

When it happens

Trigger: ADC loaded a client whose credentials have no access token (e.g. an external-account config with an expired source token); a metadata server returned an empty body; the credential source was a file that existed but was empty.

Common situations: Workload Identity Federation with a broken credential source; an expired or revoked service-account key that still loads but yields no token; metadata server hiccup returning 200 with empty body.

Related errors

• Failed to get ADC access token: ${e instanceof Error ? e.mes
• Failed to get ADC ID token: ${e instanceof Error ? e.message
• Protocol "${urlObj.protocol}" is not secure. Google Credenti
• Host "${hostname}" is not an allowed host for Google Credent
• Environment variable '${envVar}' is not set or is empty. Ple

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/f10d743145b54110. Report an issue: GitHub.