googleapis/mcp-toolbox · error

failed to create logadmin client for project %q: %w

Error message

failed to create logadmin client for project %q: %w

What it means

This error wraps failures from logadmin.NewClient when building a Cloud Logging client using a user-supplied OAuth token via oauth2.StaticTokenSource. It is thrown by initLogAdminConnectionWithOAuthToken, so the root cause is almost always transport/option problems rather than credential lookup, since the token source is provided statically.

Source

Thrown at internal/sources/cloudloggingadmin/cloud_logging_admin.go:425

}

func initLogAdminConnectionWithOAuthToken(
	ctx context.Context,
	tracer trace.Tracer,
	project, name, userAgent, tokenString string,
) (*logadmin.Client, error) {
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)
	defer span.End()

	token := &oauth2.Token{
		AccessToken: string(tokenString),
	}
	ts := oauth2.StaticTokenSource(token)

	// Initialize the logadmin client with tokenSource
	client, err := logadmin.NewClient(ctx, project, option.WithUserAgent(userAgent), option.WithTokenSource(ts))
	if err != nil {
		return nil, fmt.Errorf("failed to create logadmin client for project %q: %w", project, err)
	}
	return client, nil
}

func newLogAdminClientCreator(
	ctx context.Context,
	tracer trace.Tracer,
	project, name string,
) (LogAdminClientCreator, error) {
	userAgent, err := util.UserAgentFromContext(ctx)
	if err != nil {
		return nil, err
	}

	return func(tokenString string) (*logadmin.Client, error) {
		return initLogAdminConnectionWithOAuthToken(ctx, tracer, project, name, userAgent, tokenString)
	}, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Inspect the wrapped %w error for the transport-level cause
2. Verify the project ID is a valid GCP project string
3. Check network/proxy access to logging.googleapis.com
4. Verify the supplied access token is a fresh, valid OAuth2 token for the Logging scope

Example fix

// before
client, err := logadmin.NewClient(ctx, "", option.WithTokenSource(ts)) // empty project
// after
client, err := logadmin.NewClient(ctx, "my-gcp-project", option.WithUserAgent(userAgent), option.WithTokenSource(ts))

if project == "" { return fmt.Errorf("project ID required") }
if token == "" || strings.Count(token, ".") != 2 {
    return fmt.Errorf("access token missing or not a JWT")
}

if err != nil {
    return fmt.Errorf("logadmin client (oauth) init failed: %w", err)
}

When it happens

Trigger: Calling the OAuth-token path of client creation where logadmin.NewClient(ctx, project, option.WithUserAgent(...), option.WithTokenSource(ts)) fails — e.g. transport dial failure or invalid project string.

Common situations: Network/proxy blocking googleapis.com; invalid or empty project ID; SDK version incompatibilities building the gRPC client; expired/static access token surfaced later at request time rather than at client creation.

Related errors

• failed to create Cloud Logging Admin client for project %q:
• unable to initialize server: %w
• failed to read manual PRM file at startup: %w
• error in User Agent retrieval: %s
• failed to find default credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/b7db1ee2396a4f04. Report an issue: GitHub.