googleapis/mcp-toolbox · error

client-side OAuth is enabled but no access token was provide

Error message

client-side OAuth is enabled but no access token was provided

What it means

GetClient refuses to build a per-request DataChatClient when the source has UseClientOAuth enabled but the incoming request did not carry an access token. With client-side OAuth the server holds no credentials of its own, so the caller's token is mandatory.

Source

Thrown at internal/sources/cloudgda/cloud_gda.go:131

	if scope == "" {
		scope = CloudPlatformScope
	}

	creds, err := google.FindDefaultCredentials(ctx, scope)
	if err != nil {
		return nil, fmt.Errorf("failed to find default credentials: %w", err)
	}
	return creds.TokenSource, nil
}

func (s *Source) UseClientAuthorization() bool {
	return s.UseClientOAuth
}

func (s *Source) GetClient(ctx context.Context, tokenStr string) (*geminidataanalytics.DataChatClient, func(), error) {
	if s.UseClientOAuth {
		if tokenStr == "" {
			return nil, nil, fmt.Errorf("client-side OAuth is enabled but no access token was provided")
		}
		token := &oauth2.Token{AccessToken: tokenStr}
		opts := []option.ClientOption{
			option.WithUserAgent(s.userAgent),
			option.WithTokenSource(oauth2.StaticTokenSource(token)),
		}

		client, err := NewDataChatClient(ctx, opts...)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to create per-request DataChatClient: %w", err)
		}
		return client, func() { client.Close() }, nil
	}
	return s.Client, func() {}, nil
}

func (s *Source) RunQuery(ctx context.Context, tokenStr string, req *geminidataanalyticspb.QueryDataRequest) (*geminidataanalyticspb.QueryDataResponse, error) {
	client, cleanup, err := s.GetClient(ctx, tokenStr)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Include an OAuth access token in the request's authorization header (or the tool's configured auth token header)
2. Add authRequired: [my-google-auth-service] to the tool definition so clients obtain and send the token
3. Verify the client (e.g. MCP host) is configured to inject Google OAuth tokens
4. If server credentials are preferred, remove UseClientOAuth and rely on ADC

Example fix

// before
{
  "tools": {"ask_data": {"source": "gda"}}
}
// after
{
  "tools": {"ask_data": {"source": "gda", "authRequired": ["my-google-auth-service"]}}
}

// client-side check before invoking run_query
if useClientOAuth && token == "" {
    return errors.New("client-side OAuth is enabled: supply an access token in the authorization header")
}

When it happens

Trigger: Configuring the cloudgda source with UseClientOAuth: true, then calling run_query without providing an authorization token in the request headers (my-auth-token/authorization token empty).

Common situations: Calling the tool via MCP/HTTP without setting the auth header, forgetting to configure authRequired on the tool so clients know to supply a token, or sending an empty token string after auth middleware.

Related errors

• no access token supplied with request
• error parsing access token: %w
• error creating client from OAuth access token: %w
• failed to create DataChatClient: %w
• failed to find default credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/b9741446b8ab8a4b. Report an issue: GitHub.