googleapis/mcp-toolbox · error

failed to find default Google Cloud credentials for project

Error message

failed to find default Google Cloud credentials for project %q: %w

What it means

When no impersonation is configured, the source falls back to Application Default Credentials via google.FindDefaultCredentials with the configured scopes. This error means no usable ADC could be located in the environment, so the Dataplex clients cannot be built. It is the classic 'no credentials found' initialization failure.

Source

Thrown at internal/sources/dataplex/dataplex.go:219

	if impersonateServiceAccount != "" {
		// Create impersonated credentials token source
		ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
			TargetPrincipal: impersonateServiceAccount,
			Scopes:          credScopes,
		})
		if err != nil {
			return nil, nil, nil, nil, fmt.Errorf("failed to create impersonated credentials for %q for project %q: %w", impersonateServiceAccount, project, err)
		}
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithTokenSource(ts),
		}
	} else {
		// Use default credentials
		cred, err := google.FindDefaultCredentials(ctx, credScopes...)
		if err != nil {
			return nil, nil, nil, nil, fmt.Errorf("failed to find default Google Cloud credentials for project %q: %w", project, err)
		}
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithCredentials(cred),
		}
	}

	client, err := dataplexapi.NewCatalogClient(ctx, opts...)
	if err != nil {
		return nil, nil, nil, nil, fmt.Errorf("failed to create Dataplex client for project %q: %w", project, err)
	}

	dataScanClient, err := dataplexapi.NewDataScanClient(ctx, opts...)
	if err != nil {
		client.Close()
		return nil, nil, nil, nil, fmt.Errorf("failed to create Dataplex DataScan client for project %q: %w", project, err)
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run `gcloud auth application-default login` on your local machine.
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account key JSON: `export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json` and confirm the file exists and parses.
3. If running on GCP, attach a service account to the compute resource (VM/Cloud Run/GKE) instead of relying on key files.
4. If you meant to impersonate, set the `impersonateServiceAccount` field in the source config.
5. Regenerate the key file if it was revoked/deleted, and validate the JSON is well-formed.

Example fix

// before (shell)
./toolbox --tools-file tools.yaml   # no ADC present
// after (shell)
gcloud auth application-default login
./toolbox --tools-file tools.yaml

test -n "$GOOGLE_APPLICATION_CREDENTIALS" && test -f "$GOOGLE_APPLICATION_CREDENTIALS" && echo ok || gcloud auth application-default print-access-token >/dev/null && echo ok || echo 'no ADC found'

src, err := cfg.Initialize(ctx, tracer)
if err != nil {
	if strings.Contains(err.Error(), "failed to find default Google Cloud credentials") {
		log.Fatalf("no Application Default Credentials; run 'gcloud auth application-default login': %v", err)
	}
	return err
}

When it happens

Trigger: initDataplexConnection with empty impersonateServiceAccount calls google.FindDefaultCredentials(ctx, credScopes...) and no credential chain matches: no GOOGLE_APPLICATION_CREDENTIALS, no gcloud user creds, no metadata server (e.g. outside GCP without a key file).

Common situations: Running the toolbox locally without `gcloud auth application-default login`; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing/deleted key file; container without a mounted SA key; malformed credentials JSON.

Related errors

• failed to initialize dataplex client: %w
• failed to find default Google Cloud credentials: %w
• failed to get dataplex client: %w
• unable to create bigtable.NewClient: %w
• failed to find default credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/cf5e19bf59d6279c. Report an issue: GitHub.