googleapis/mcp-toolbox · error

error creating client from ADC: %w

Error message

error creating client from ADC: %w

What it means

When useClientOAuth is disabled ("false" or empty), Initialize builds a server-side client via Application Default Credentials (initBigQueryConnection). Any failure in that path — credential discovery, token source creation, quota project, impersonation, or client construction — is wrapped in this error.

Source

Thrown at internal/sources/bigquery/bigquery.go:198

	var restService *bigqueryrestapi.Service
	var tokenSource oauth2.TokenSource
	var clientCreator BigqueryClientCreator
	var err error

	s := &Source{
		Config:              r,
		Client:              client,
		RestService:         restService,
		TokenSource:         tokenSource,
		ClientCreator:       clientCreator,
		AuthTokenHeaderName: "Authorization",
	}

	if strings.ToLower(r.UseClientOAuth) == "false" || r.UseClientOAuth == "" {
		// Initializes a BigQuery Google SQL source
		client, restService, tokenSource, err = initBigQueryConnection(ctx, tracer, r.Name, r.Project, r.Location, r.QuotaProject, r.ImpersonateServiceAccount, r.Scopes, endpoint)
		if err != nil {
			return nil, fmt.Errorf("error creating client from ADC: %w", err)
		}
		s.Client = client
		s.RestService = restService
		s.TokenSource = tokenSource

		if r.WriteMode == WriteModeProtected {
			// session-based connections
			s.SessionProvider = s.newBigQuerySessionProvider()
		}
	} else {
		if strings.ToLower(r.UseClientOAuth) != "true" {
			s.AuthTokenHeaderName = r.UseClientOAuth
		}
		// use client OAuth
		baseClientCreator, err := newBigQueryClientCreator(ctx, tracer, r.Project, r.Location, r.QuotaProject, r.Name, endpoint)
		if err != nil {
			return nil, fmt.Errorf("error constructing client creator: %w", err)
		}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run `gcloud auth application-default login` locally, or set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key.
2. Verify the impersonateServiceAccount email exists and the base identity has roles/iam.serviceAccountTokenCreator on it.
3. Check that project ID, location, and quotaProject values are valid and the account has BigQuery access.

Example fix

// before (shell, no credentials)
./toolbox
// after
gcloud auth application-default login
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json
./toolbox

creds, err := google.FindDefaultCredentials(ctx, bigqueryapi.Scope)
if err != nil {
	return fmt.Errorf("ADC unavailable, run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS: %w", err)
}

src, err := sourceRegistry.Initialize(ctx, cfg)
if err != nil {
	var adcErr interface{ Unwrap() error }
	if strings.Contains(err.Error(), "error creating client from ADC") {
		log.Fatalf("ADC setup failed; check GOOGLE_APPLICATION_CREDENTIALS / gcloud auth: %v", err)
	}
	return err
}

When it happens

Trigger: Initializing the BigQuery source without client OAuth when ADC cannot produce valid credentials: no GOOGLE_APPLICATION_CREDENTIALS, no gcloud user creds, metadata server unreachable, invalid impersonation target, or bad scopes/project/location.

Common situations: Running the toolbox in a local/dev environment without gcloud auth application-default login; container images missing the service account key file; GOOGLE_APPLICATION_CREDENTIALS pointing to a deleted or malformed JSON file.

Related errors

• error getting email from ADC: %v
• failed to find default Google Cloud credentials with scope %
• failed to find default Google Cloud credentials with scope %
• writeMode 'protected' cannot be used with useClientOAuth ena
• useClientOAuth cannot be used with impersonateServiceAccount

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/5d82bb381076aa79. Report an issue: GitHub.