googleapis/mcp-toolbox · error

error creating client from OAuth access token: %w

Error message

error creating client from OAuth access token: %w

What it means

Raised when the bearer token parsed from the request is valid syntactically, but constructing the BigQuery client (and REST service) with that user token fails. The client creator exchanges/validates the token against Google APIs, so failures reflect credential rejection or API client construction errors.

Source

Thrown at internal/sources/bigquery/bigquery.go:601

			}
		})
		return client, clientCreator, err
	}
}

func (s *Source) RetrieveClientAndService(accessToken tools.AccessToken) (*bigqueryapi.Client, *bigqueryrestapi.Service, error) {
	bqClient := s.BigQueryClient()
	restService := s.BigQueryRestService()

	// Initialize new client if using user OAuth token
	if s.UseClientAuthorization() {
		tokenStr, err := accessToken.ParseBearerToken()
		if err != nil {
			return nil, nil, fmt.Errorf("error parsing access token: %w", err)
		}
		bqClient, restService, err = s.BigQueryClientCreator()(tokenStr, true)
		if err != nil {
			return nil, nil, fmt.Errorf("error creating client from OAuth access token: %w", err)
		}
	}
	return bqClient, restService, nil
}

func (s *Source) RunSQL(ctx context.Context, bqClient *bigqueryapi.Client, statement, statementType string, params []bigqueryapi.QueryParameter, connProps []*bigqueryapi.ConnectionProperty, labels map[string]string) (any, error) {
	query := bqClient.Query(statement)
	query.Location = bqClient.Location
	if params != nil {
		query.Parameters = params
	}
	if connProps != nil {
		query.ConnectionProperties = connProps
	}
	if labels != nil {
		query.Labels = labels
	}
	if s.MaximumBytesBilled > 0 {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Refresh the OAuth token and retry with a fresh access token
2. Ensure the OAuth consent/scopes include https://www.googleapis.com/auth/bigquery (or cloud-platform)
3. Verify the source's project ID is correct and the BigQuery API is enabled
4. If using impersonation with user tokens, confirm the account can impersonate the target service account (roles/iam.serviceAccountTokenCreator)

Example fix

// before
client := oauth2.Client(ctx, expiredToken)
// after
tokenSrc := expiredToken.TokenSource(ctx)
fresh, _ := tokenSrc.Token()
client := oauth2.NewClient(ctx, oauth2.ReuseTokenSource(fresh, tokenSrc))

if time.Now().After(token.Expiry.Add(-1 * time.Minute)) {
    return errors.New("access token expired; refresh before calling the tool")
}

client, svc, err := src.RetrieveClientAndService(accessToken)
if err != nil && strings.Contains(err.Error(), "error creating client from OAuth access token") {
    // likely expired/insufficient-scope token: refresh and retry once
    newTok, rerr := refresh(ctx)
    if rerr != nil { return rerr }
    client, svc, err = src.RetrieveClientAndService(newTok)
    return err
}

When it happens

Trigger: Source has UseClientAuthorization enabled; ParseBearerToken succeeded, then BigQueryClientCreator()(tokenStr, true) fails — e.g. the token is expired or revoked, lacks bigquery scopes, the project is invalid, or options like impersonation cannot be applied with the user token.

Common situations: Expired/revoked user OAuth token, token issued without cloud-platform or bigquery scope, wrong project ID in source config, or disabled BigQuery API in the project.

Related errors

• writeMode 'protected' cannot be used with useClientOAuth ena
• useClientOAuth cannot be used with impersonateServiceAccount
• error constructing client creator: %w
• failed to initialize dataplex client: %w
• error parsing access token: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/0bd70b794df0eed9. Report an issue: GitHub.