googleapis/mcp-toolbox · error

failed to call userinfo endpoint: %w

Error message

failed to call userinfo endpoint: %w

What it means

google.DefaultClient failed while resolving Application Default Credentials for the userinfo.email scope — ADC is missing, expired, or the credential file is malformed, so no authenticated HTTP client can be built for the IAM email lookup.

Source

Thrown at internal/sources/util.go:89

	case "psc":
		opts = append(opts, cloudsqlconn.WithDefaultDialOptions(cloudsqlconn.WithPSC()))
	default:
		return nil, fmt.Errorf("invalid ipType %s. Must be one of `public`, `private`, or `psc`", ipType)
	}

	if useIAM {
		opts = append(opts, cloudsqlconn.WithIAMAuthN())
	}
	return opts, nil
}

// GetIAMPrincipalEmailFromADC finds the email associated with ADC
func GetIAMPrincipalEmailFromADC(ctx context.Context, dbType string) (string, error) {
	// Finds ADC and returns an HTTP client associated with it
	client, err := google.DefaultClient(ctx,
		"https://www.googleapis.com/auth/userinfo.email")
	if err != nil {
		return "", fmt.Errorf("failed to call userinfo endpoint: %w", err)
	}

	// Retrieve the email associated with the token
	resp, err := client.Get("https://oauth2.googleapis.com/tokeninfo")
	if err != nil {
		return "", fmt.Errorf("failed to call tokeninfo endpoint: %w", err)
	}
	defer resp.Body.Close()

	bodyBytes, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", fmt.Errorf("error reading response body %d: %s", resp.StatusCode, string(bodyBytes))
	}
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("tokeninfo endpoint returned non-OK status %d: %s", resp.StatusCode, string(bodyBytes))
	}

	// Unmarshal response body and get `email`

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run gcloud auth application-default login
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account key
3. Verify the credential scopes include userinfo.email

When it happens

Trigger: Thrown at internal/sources/util.go:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/dae555595889a701. Report an issue: GitHub.