googleapis/mcp-toolbox · error

failed to find default credentials: %w

Error message

failed to find default credentials: %w

What it means

This error wraps google.FindDefaultCredentials failing to locate Application Default Credentials for the Cloud SQL Admin API scope (sqladmin.SqlserviceAdminScope). It occurs in Initialize when UseClientOAuth is false and no ADC chain can be found in the environment.

Source

Thrown at internal/sources/cloudsqladmin/cloud_sql_admin.go:90

}

// Initialize initializes a CloudSQL Admin Source instance.
func (r Config) Initialize(ctx context.Context, tracer trace.Tracer) (sources.Source, error) {
	ua, err := util.UserAgentFromContext(ctx)
	if err != nil {
		return nil, fmt.Errorf("error in User Agent retrieval: %s", err)
	}

	var client *http.Client
	if r.UseClientOAuth {
		client = &http.Client{
			Transport: util.NewUserAgentRoundTripper(ua, http.DefaultTransport),
		}
	} else {
		// Use Application Default Credentials
		creds, err := google.FindDefaultCredentials(ctx, sqladmin.SqlserviceAdminScope)
		if err != nil {
			return nil, fmt.Errorf("failed to find default credentials: %w", err)
		}
		baseClient := oauth2.NewClient(ctx, creds.TokenSource)
		baseClient.Transport = util.NewUserAgentRoundTripper(ua, baseClient.Transport)
		client = baseClient
	}

	service, err := sqladmin.NewService(ctx, option.WithHTTPClient(client))
	if err != nil {
		return nil, fmt.Errorf("error creating new sqladmin service: %w", err)
	}

	s := &Source{
		Config:  r,
		BaseURL: "https://sqladmin.googleapis.com",
		Service: service,
	}
	return s, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run 'gcloud auth application-default login' for local development
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid Cloud SQL Admin-capable service-account JSON key
3. Enable UseClientOAuth and supply client access tokens instead of server ADC
4. Verify the Cloud SQL Admin API is enabled and the account has cloudsql Admin roles

Example fix

// before
creds, err := google.FindDefaultCredentials(ctx, sqladmin.SqlserviceAdminScope) // no ADC
// after
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json
creds, err := google.FindDefaultCredentials(ctx, sqladmin.SqlserviceAdminScope)

creds, err := google.FindDefaultCredentials(ctx, sqladmin.SqlserviceAdminScope)
if err != nil {
    return fmt.Errorf("ADC unavailable before init: %w", err)
}

if err != nil {
    if strings.Contains(err.Error(), "could not find default credentials") {
        log.Fatal("run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS")
    }
    return err
}

When it happens

Trigger: Initializing a cloudsqladmin source with UseClientOAuth=false while no credential source exists: GOOGLE_APPLICATION_CREDENTIALS unset or pointing to a missing/invalid key, no gcloud user credentials, and no GCE metadata server.

Common situations: Running the toolbox outside GCP without a service-account key; forgetting 'gcloud auth application-default login'; container images without credentials mounted; key files with wrong permissions.

Related errors

• failed to find default credentials: %w
• failed to find default Google Cloud credentials: %w
• failed to create Cloud Logging Admin client for project %q:
• error in User Agent retrieval: %s
• error creating new sqladmin service: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/0051cbda126229ac. Report an issue: GitHub.