googleapis/mcp-toolbox · error

failed to find default credentials (run 'gcloud auth applica

Error message

failed to find default credentials (run 'gcloud auth application-default login'?): %w

What it means

GetIAMAccessToken calls google.FindDefaultCredentials to locate Application Default Credentials for the cloud-platform scope. When no usable ADC can be found (no gcloud user credentials, no GOOGLE_APPLICATION_CREDENTIALS, no attached service account, etc.), the underlying error is wrapped with this message to point the developer at the most common fix: running 'gcloud auth application-default login'.

Source

Thrown at internal/sources/util.go:149

	case "postgres":
		// service account email used for IAM should trim the suffix
		username = strings.TrimSuffix(fullEmail, ".gserviceaccount.com")

	default:
		return "", fmt.Errorf("unsupported dbType: %s. Use 'mysql' or 'postgres'", dbType)
	}

	if username == "" {
		return "", fmt.Errorf("username from ADC cannot be an empty string")
	}

	return username, nil
}

func GetIAMAccessToken(ctx context.Context) (string, error) {
	creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return "", fmt.Errorf("failed to find default credentials (run 'gcloud auth application-default login'?): %w", err)
	}

	token, err := creds.TokenSource.Token() // This gets an oauth2.Token
	if err != nil {
		return "", fmt.Errorf("failed to get token from token source: %w", err)
	}

	if !token.Valid() {
		return "", fmt.Errorf("retrieved token is invalid or expired")
	}
	return token.AccessToken, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run 'gcloud auth application-default login' locally to create user ADC
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account JSON key file
3. In GCP environments (GCE/GKE/Cloud Run), attach a service account to the workload
4. In CI, inject credentials via the workload identity federation or a mounted key file

Example fix

// before: no credentials in environment
// (error at runtime)
// after
gcloud auth application-default login
# or
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json

import { GoogleAuth } from "google-auth-library";
try {
  const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] });
  const client = await auth.getClient(); // throws early if no ADC
} catch (e) {
  console.error("No ADC found; run 'gcloud auth application-default login'");
}

try {
  const token = await getIAMAccessToken(ctx);
} catch (err) {
  if (String(err).includes("failed to find default credentials")) {
    // surface remediation hint or fall back to explicit credentials
    process.env.GOOGLE_APPLICATION_CREDENTIALS ??= "/path/to/key.json";
  }
  throw err;
}

When it happens

Trigger: Any call to GetIAMAccessToken (used by BigQuery tools and Cloud SQL IAM auth) in an environment where ADC resolution fails: fresh machine, CI container without credentials, or GOOGLE_APPLICATION_CREDENTIALS pointing at a missing/invalid file.

Common situations: Local development on a new machine before ever running 'gcloud auth application-default login'; Docker/CI environments with no GCP credentials mounted; a typo'd or deleted path in GOOGLE_APPLICATION_CREDENTIALS; running on a VM without a service account attached.

Related errors

• failed to find default Google Cloud credentials: %w
• failed to find default credentials: %w
• error creating service from ADC: %w
• failed to find default Google Cloud credentials with scope %
• failed to create authenticated HTTP client: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/b12d3758875e2618. Report an issue: GitHub.