googleapis/mcp-toolbox · error

failed to find default Google Cloud credentials with scope %

Error message

failed to find default Google Cloud credentials with scope %q: %w

What it means

initLogAdminConnection, when no explicit service account key or client OAuth token is configured, falls back to Application Default Credentials via google.FindDefaultCredentials with the Cloud Logging Admin scope. This error means ADC could not locate any usable credentials on the host, wrapped with the requested scope (https://www.googleapis.com/auth/logging.admin).

Source

Thrown at internal/sources/cloudloggingadmin/cloud_logging_admin.go:393

		cloudPlatformTokenSource, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
			TargetPrincipal: impersonateServiceAccount,
			Scopes:          []string{"https://www.googleapis.com/auth/cloud-platform"},
		})

		if err != nil {
			return nil, nil, fmt.Errorf("failed to create impersonated credentials for %q: %w", impersonateServiceAccount, err)
		}

		tokenSource = cloudPlatformTokenSource
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithTokenSource(cloudPlatformTokenSource),
		}
	} else {
		// Use default credentials
		cred, err := google.FindDefaultCredentials(ctx, logging.AdminScope)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to find default Google Cloud credentials with scope %q: %w", logging.AdminScope, err)
		}
		tokenSource = cred.TokenSource
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithCredentials(cred),
		}
	}

	client, err := logadmin.NewClient(ctx, project, opts...)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to create Cloud Logging Admin client for project %q: %w", project, err)
	}
	return client, tokenSource, nil
}

func initLogAdminConnectionWithOAuthToken(
	ctx context.Context,
	tracer trace.Tracer,

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Set GOOGLE_APPLICATION_CREDENTIALS to the path of a valid service-account JSON key that has the Cloud Logging Admin role
2. Or run `gcloud auth application-default login` locally to install user ADC credentials
3. If running in Docker/K8s, mount the key file or attach the workload's service account; verify metadata server access on GCE/Cloud Run
4. Verify GOOGLE_APPLICATION_CREDENTIALS actually points to an existing readable file (no typo) and the key has logging scope permissions
5. Alternatively configure explicit credentials in the source YAML instead of relying on ADC

Example fix

// before: no credentials anywhere
export PATH=$PATH:toolbox && ./toolbox --tools "my-logging-tools"
// failed to find default Google Cloud credentials with scope "https://www.googleapis.com/auth/logging.admin"
// after
gcloud auth application-default login
export GOOGLE_APPLICATION_CREDENTIALS=$HOME/.config/gcloud/application_default_credentials.json
./toolbox --tools "my-logging-tools"

// Node/Go-style preflight: confirm ADC resolves before starting the toolbox
const { GoogleAuth } = require('google-auth-library');
async function assertADC() {
  try { const c = await new GoogleAuth({ scopes: ['https://www.googleapis.com/auth/logging.admin'] }).getClient(); return !!c; }
  catch (e) { throw new Error('No Application Default Credentials: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS'); }
}

try {
  await source.initialize();
} catch (e) {
  if (/failed to find default Google Cloud credentials/.test(e.message)) {
    // fall back to explicit service-account key configured in the YAML
    await source.initializeWithKeyFile(keyFile);
  } else { throw e; }
}

When it happens

Trigger: Initialize() for the cloudloggingadmin source runs on a machine with no GOOGLE_APPLICATION_CREDENTIALS env var, no gcloud user credentials (~/.config/gcloud/application_default_credentials.json), and no attached GCE/GKE/Cloud Run service account, and no explicit credentials in the toolbox YAML.

Common situations: Running the toolbox locally without ever running `gcloud auth application-default login`; a Docker container without the service-account key mounted; GOOGLE_APPLICATION_CREDENTIALS pointing to a missing/deleted file; migrating code from a GCE VM to a laptop.

Related errors

• failed to find default credentials: %w
• error creating service from ADC: %w
• failed to find default Google Cloud credentials with scope %
• failed to create authenticated HTTP client: %w
• failed to find default Google Cloud credentials with scope %

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/8fde7d767876e637. Report an issue: GitHub.