google-gemini/gemini-cli · critical · FatalAuthenticationError

${originalMessage}. The initial COMPUTE_ADC attempt also fai

Error message

${originalMessage}. The initial COMPUTE_ADC attempt also failed: ${adcMessage}

What it means

FatalAuthenticationError thrown when USE_CCPA is set, COMPUTE_ADC failed (triggering the LOGIN_WITH_GOOGLE fallback), and the OAuth fallback itself threw a FatalAuthenticationError. The handler concatenates the OAuth failure message with the original ADC failure message so both root causes are visible. Non-Fatal errors from the OAuth path are rethrown unchanged.

Source

Thrown at packages/a2a-server/src/config/config.ts:635

      if (isHeadless || useComputeAdc) {
        const reason = isHeadless
          ? 'headless mode'
          : 'GEMINI_CLI_USE_COMPUTE_ADC=true';
        throw new FatalAuthenticationError(
          `COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallback skipped due to ${reason}. Run in an interactive terminal to use OAuth.)`,
        );
      }

      logger.info(
        `[${logPrefix}] COMPUTE_ADC failed, falling back to LOGIN_WITH_GOOGLE.`,
      );
      try {
        await config.refreshAuth(AuthType.LOGIN_WITH_GOOGLE);
      } catch (e) {
        if (e instanceof FatalAuthenticationError) {
          const originalMessage = e instanceof Error ? e.message : String(e);
          throw new FatalAuthenticationError(
            `${originalMessage}. The initial COMPUTE_ADC attempt also failed: ${adcMessage}`,
          );
        }
        throw e;
      }
    }

    logger.info(
      `[${logPrefix}] GOOGLE_CLOUD_PROJECT: ${getEnvLocal('GOOGLE_CLOUD_PROJECT')}`,
    );
  } else if (getEnvLocal('GEMINI_API_KEY')) {
    logger.info(`[${logPrefix}] Using Gemini API Key`);
    await config.refreshAuth(
      AuthType.USE_GEMINI,
      getEnvLocal('GEMINI_API_KEY'),
    );
  } else {
    const errorMessage = `[${logPrefix}] Unable to set GeneratorConfig. Please provide a GEMINI_API_KEY or set USE_CCPA.`;

View on GitHub (pinned to 5024443c72)

Solutions

1. Clear the cached OAuth credentials (gemini auth logout / remove the cached token file) and re-run login in an interactive terminal.
2. Address the COMPUTE_ADC failure per the embedded adcMessage (set GOOGLE_APPLICATION_CREDENTIALS or run on GCE).
3. Fall back to GEMINI_API_KEY auth if OAuth cannot be repaired.
4. Check the originalMessage portion for the specific OAuth fatal reason.

Example fix

# before: both ADC and OAuth broken
export USE_CCPA=true

# after: clear OAuth cache and use API key
unset USE_CCPA
export GEMINI_API_KEY=...
# (or) gemini auth login  # in an interactive terminal

try {
  await refreshAuthentication(config, logPrefix, envVars);
} catch (e) {
  if (e instanceof FatalAuthenticationError) {
    // both ADC and OAuth failed; switch strategy
    envVars['GEMINI_API_KEY'] = process.env['GEMINI_API_KEY']!;
    delete envVars['USE_CCPA'];
    await refreshAuthentication(config, logPrefix, envVars);
    return;
  }
  throw e;
}

When it happens

Trigger: Both auth paths fail: COMPUTE_ADC is unavailable AND the interactive LOGIN_WITH_GOOGLE flow hits a fatal error (e.g. browser open failed in a non-headless-but-broken environment, OAuth consent rejected, cached token corrupt). The catch at line 633 detects a FatalAuthenticationError and merges messages.

Common situations: Workstation with stale OAuth tokens where ADC also isn't provisioned; OAuth token cache corrupted; clock skew breaking token validation while ADC lacks a metadata server.

Related errors

• COMPUTE_ADC failed: ${adcMessage}. (LOGIN_WITH_GOOGLE fallba
• Could not authenticate using metadata server application def
• Manual authorization is required but the current session is
• Failed to authenticate with user code.
• Authentication cancelled by user.

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/3dd3102cefcbd98a. Report an issue: GitHub.