failed to find default Google Cloud credentials with scopes

Error message

failed to find default Google Cloud credentials with scopes %v: %w

What it means

This error is thrown when no impersonation service account is configured and the library falls back to Application Default Credentials, calling google.FindDefaultCredentials with the BigQuery/cloud-platform scopes. If no usable credential chain is found for those scopes (gcloud ADC file, GOOGLE_APPLICATION_CREDENTIALS, metadata server, etc.), the error is wrapped with the requested scopes. It is the standard 'no credentials available' failure from golang.org/x/oauth2/google.

Source

Thrown at internal/sources/bigquery/bigquery.go:799

		// Create impersonated credentials token source
		// This broader scope is needed for tools like conversational analytics
		cloudPlatformTokenSource, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
			TargetPrincipal: impersonateServiceAccount,
			Scopes:          credScopes,
		})
		if err != nil {
			return nil, nil, nil, fmt.Errorf("failed to create impersonated credentials for %q: %w", impersonateServiceAccount, err)
		}
		tokenSource = cloudPlatformTokenSource
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithTokenSource(cloudPlatformTokenSource),
		}
	} else {
		// Use default credentials
		cred, err := google.FindDefaultCredentials(ctx, credScopes...)
		if err != nil {
			return nil, nil, nil, fmt.Errorf("failed to find default Google Cloud credentials with scopes %v: %w", credScopes, err)
		}
		tokenSource = cred.TokenSource
		opts = []option.ClientOption{
			option.WithUserAgent(userAgent),
			option.WithCredentials(cred),
		}
	}

	if endpoint != "" {
		opts = append(opts, option.WithEndpoint(endpoint))
	}
	if quotaProject != "" {
		opts = append(opts, option.WithQuotaProject(quotaProject))
	}

	// Initialize the high-level BigQuery client
	client, err := bigqueryapi.NewClient(ctx, project, opts...)
	if err != nil {

View on GitHub (pinned to 8cc6e09de2)

Solutions

Run 'gcloud auth application-default login' (with --scopes if needed) on local development machines.
Set GOOGLE_APPLICATION_CREDENTIALS to a valid service account key JSON file.
Attach a service account with BigQuery access when running on GCP infrastructure.
Alternatively configure impersonateServiceAccount so the default-credential path is skipped.
Verify the credential file is valid JSON and readable.

Example fix

// before
export GOOGLE_APPLICATION_CREDENTIALS=/old/path/key.json  // file deleted
// after
gcloud auth application-default login
# or
export GOOGLE_APPLICATION_CREDENTIALS=$HOME/keys/bq-reader.json

Defensive patterns

Strategy: validation

Validate before calling

// Validate ADC before starting the toolbox
import "google.golang.org/api/option"
import "golang.org/x/oauth2/google"
credScopes := []string{"https://www.googleapis.com/auth/cloud-platform"}
if _, err := google.FindDefaultCredentials(context.Background(), credScopes...); err != nil {
  return fmt.Errorf("ADC unavailable: %w — run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS", err)
}

Try / catch

// Go
if _, _, _, err := initBigQueryConnection(ctx, cfg); err != nil {
  if strings.Contains(err.Error(), "failed to find default Google Cloud credentials") {
    log.Fatalf("no ADC found: %v — run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS", err)
  }
}

Prevention

Always run 'gcloud auth application-default login' in local dev environments.
Keep GOOGLE_APPLICATION_CREDENTIALS pointing at an existing, valid key file; check with a startup probe.
Attach a service account when deploying to GCP; avoid relying on fallback chains.
Validate credentials early at startup rather than at first query.

When it happens

Trigger: No impersonateServiceAccount is set, and google.FindDefaultCredentials(ctx, credScopes...) fails because GOOGLE_APPLICATION_CREDENTIALS points to a missing/invalid file, no ~/.config/gcloud/application_default_credentials.json exists, and no GCE/GKE/Cloud Run metadata server is reachable.

Common situations: Running the toolbox locally without ever running 'gcloud auth application-default login'; GOOGLE_APPLICATION_CREDENTIALS set to a deleted or malformed key file; service account key JSON missing required scopes; deploying to an environment without an attached service account.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/da611175483ea033. Report an issue: GitHub.