googleapis/mcp-toolbox · error

failed to find default Google Cloud credentials with scope %

Error message

failed to find default Google Cloud credentials with scope %q: %w

What it means

initGoogleCloudConnection calls google.FindDefaultCredentials with the Gemini Data Analytics scopes; when Application Default Credentials cannot be located, the error is wrapped with the requested scopes. This means no workload identity, gcloud ADC, GOOGLE_APPLICATION_CREDENTIALS, or metadata-server credentials were available. It is a startup-time failure during source Initialize.

Source

Thrown at internal/sources/looker/looker.go:286

				Base:      transport,
				AuthToken: accessToken,
				clientIP:  clientIP,
			},
		}
		// return SDK with new Transport
		return v4.NewLookerSDK(session), nil
	}

	if s.LookerClient() == nil {
		return nil, fmt.Errorf("client id or client secret not valid")
	}
	return s.LookerClient(), nil
}

func initGoogleCloudConnection(ctx context.Context) (oauth2.TokenSource, error) {
	cred, err := google.FindDefaultCredentials(ctx, geminidataanalytics.DefaultAuthScopes()...)
	if err != nil {
		return nil, fmt.Errorf("failed to find default Google Cloud credentials with scope %q: %w", geminidataanalytics.DefaultAuthScopes(), err)
	}

	return cred.TokenSource, nil
}

func (s *Source) GetHostURL(ctx context.Context, sdk *v4.LookerSDK) (string, error) {
	defaultURL := strings.TrimSuffix(s.ApiSettings.BaseUrl, "/")

	if sdk == nil {
		return defaultURL, nil
	}

	// 1. Fast path: Read lock to check cache TTL
	s.hostURLMu.RLock()
	if !s.lastFetchFailed && !s.lastFetchTime.IsZero() && time.Since(s.lastFetchTime) < 10*time.Minute {
		urlStr := s.cachedHostURL
		s.hostURLMu.RUnlock()
		return urlStr, nil

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run `gcloud auth application-default login` on the host running the toolbox
2. Set GOOGLE_APPLICATION_CREDENTIALS to the path of a valid service-account JSON key
3. If on GCP, attach the service account / ensure workload identity is configured so the metadata server supplies credentials
4. Verify the service account has access to the Gemini Data Analytics API scopes

Example fix

// before (shell)
go run .
// after
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json
go run .

_, err := google.FindDefaultCredentials(context.Background(), geminidataanalytics.DefaultAuthScopes()...)
if err != nil {
    return fmt.Errorf("no ADC available: %w", err)
}

ts, err := initGoogleCloudConnection(ctx)
if err != nil {
    // check GOOGLE_APPLICATION_CREDENTIALS and run gcloud auth application-default login
    return fmt.Errorf("google auth bootstrap failed: %w", err)
}

When it happens

Trigger: Initialize -> initGoogleCloudConnection when the environment has no default Google Cloud credentials resolvable for the geminidataanalytics scopes (no GOOGLE_APPLICATION_CREDENTIALS, no ~/.config/gcloud ADC, no attached service account).

Common situations: Running the toolbox locally without `gcloud auth application-default login`; container images lacking the service-account key; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing or malformed JSON file.

Related errors

• failed to find default Google Cloud credentials with scope %
• error creating client from ADC: %w
• failed to find default Google Cloud credentials: %w
• failed to find default Google Cloud credentials with scope %
• failed to find default credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/44a1afc155a65495. Report an issue: GitHub.