google-gemini/gemini-cli · error · Error

Protocol "${urlObj.protocol}" is not secure. Google Credenti

Error message

Protocol "${urlObj.protocol}" is not secure. Google Credential provider requires HTTPS.

What it means

GoogleCredentialsAuthProvider requires the target URL to use HTTPS because tokens minted for HTTP endpoints could be intercepted. The constructor parses the targetUrl with the URL constructor and compares protocol to 'https:'. Any other scheme (http:, grpc:, ws:) is rejected before any token work begins.

Source

Thrown at packages/core/src/agents/auth-provider/google-credentials-provider.ts:45

  private readonly audience?: string;
  private cachedToken?: string;
  private tokenExpiryTime?: number;

  constructor(
    private readonly config: GoogleCredentialsAuthConfig,
    targetUrl?: string,
  ) {
    super();

    if (!targetUrl) {
      throw new Error(
        'targetUrl must be provided to GoogleCredentialsAuthProvider to determine token audience.',
      );
    }

    const urlObj = new URL(targetUrl);
    if (urlObj.protocol !== 'https:') {
      throw new Error(
        `Protocol "${urlObj.protocol}" is not secure. Google Credential provider requires HTTPS.`,
      );
    }

    const hostname = urlObj.hostname;
    const isRunAppHost = CLOUD_RUN_HOST_REGEX.test(hostname);

    if (isRunAppHost) {
      this.useIdToken = true;
    }
    this.audience = hostname;

    if (
      !this.useIdToken &&
      !ALLOWED_HOSTS.some((pattern) => pattern.test(hostname))
    ) {
      throw new Error(
        `Host "${hostname}" is not an allowed host for Google Credential provider.`,

View on GitHub (pinned to 5024443c72)

Solutions

1. Serve the target over HTTPS (use a certificate or a TLS-terminating proxy).
2. Correct the agent_card_url / targetUrl to use the https:// scheme.
3. For local dev, use a tunnel (e.g. mkcert) that provides a valid https endpoint.
4. Confirm the URL has an explicit scheme; bare hostnames can parse with an empty protocol.

Example fix

# before
auth:
  type: google-credentials
# target resolves to http://
agent_card_url: http://svc.example/.well-known/agent-card.json

# after
agent_card_url: https://svc.example/.well-known/agent-card.json

function isHttps(url: string): boolean {
  try { return new URL(url).protocol === 'https:'; } catch { return false; }
}
if (!isHttps(targetUrl)) {
  throw new Error('google-credentials requires an HTTPS targetUrl.');
}

When it happens

Trigger: An agent_card_url or targetUrl beginning with http://; a localhost dev server without TLS; a grpc:// scheme mistakenly passed as the target; a URL missing the scheme entirely so the URL parser defaults unexpectedly.

Common situations: Local development without TLS termination; an agent card URL copied with http; a proxy in front of the agent that terminates TLS but the configured URL still says http; misconfiguring targetUrl vs the grpc URL.

Related errors

• Host "${hostname}" is not an allowed host for Google Credent
• Failed to get ADC ID token: ${e instanceof Error ? e.message
• Failed to retrieve ADC access token.
• Failed to get ADC access token: ${e instanceof Error ? e.mes
• Path validation failed: ${pathError}

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/dfa9837c2859d03a. Report an issue: GitHub.