googleapis/mcp-toolbox · error

failed to find default Google Cloud credentials: %w

Error message

failed to find default Google Cloud credentials: %w

What it means

This error is thrown when google.FindDefaultCredentials() (golang.org/x/oauth2/google) cannot locate Application Default Credentials (ADC) for the requested scopes during Dataplex client setup, in the non-impersonation path. ADC resolution checks GOOGLE_APPLICATION_CREDENTIALS, gcloud user credentials, GCE/Metadata server, and workload identity in order. Failure means none of these sources yielded usable credentials.

Source

Thrown at internal/sources/bigquery/bigquery.go:953

		if impersonateServiceAccount != "" {
			// Create impersonated credentials token source
			ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
				TargetPrincipal: impersonateServiceAccount,
				Scopes:          credScopes,
			})
			if err != nil {
				return nil, nil, fmt.Errorf("failed to create impersonated credentials for %q: %w", impersonateServiceAccount, err)
			}
			opts = []option.ClientOption{
				option.WithUserAgent(userAgent),
				option.WithTokenSource(ts),
			}
		} else {
			// Use default credentials
			cred, err := google.FindDefaultCredentials(ctx, credScopes...)
			if err != nil {
				return nil, nil, fmt.Errorf("failed to find default Google Cloud credentials: %w", err)
			}
			opts = []option.ClientOption{
				option.WithUserAgent(userAgent),
				option.WithCredentials(cred),
			}
		}

		client, err = dataplexapi.NewCatalogClient(ctx, opts...)
		if err != nil {
			return nil, nil, fmt.Errorf("failed to create Dataplex client for project %q: %w", project, err)
		}
	}

	return client, clientCreator, nil
}

func initDataplexConnectionWithOAuthToken(
	ctx context.Context,

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Run `gcloud auth application-default login` on your dev machine to create ADC.
2. Set GOOGLE_APPLICATION_CREDENTIALS to a valid service-account JSON key file and verify it parses: `cat $GOOGLE_APPLICATION_CREDENTIALS | jq .client_email`.
3. If in Docker/K8s, mount the key file or enable Workload Identity / attach a service account to the compute resource.
4. Ensure the key's service account still exists and the key is not disabled/revoked in IAM.
5. If impersonation was intended, set the `impersonateServiceAccount` config field so this ADC path is bypassed.

Example fix

// before (shell)
./toolbox  # error: could not find default credentials
// after (shell)
gcloud auth application-default login
export GOOGLE_APPLICATION_CREDENTIALS=$HOME/.config/gcloud/application_default_credentials.json
./toolbox

// pre-check ADC before invoking the library:
if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") != "" {
    if _, err := os.Stat(os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")); err != nil {
        return fmt.Errorf("GOOGLE_APPLICATION_CREDENTIALS points to missing file")
    }
} else if _, err := exec.LookPath("gcloud"); err == nil {
    if err := exec.Command("gcloud", "auth", "application-default", "print-access-token").Run(); err != nil {
        return fmt.Errorf("no ADC: run 'gcloud auth application-default login'")
    }
}

func isMissingADCErr(err error) bool {
    return err != nil && (strings.Contains(err.Error(), "could not find default credentials") ||
        strings.Contains(err.Error(), "failed to find default Google Cloud credentials"))
}

client, creator, err := initDataplexConnection(ctx, tracer, name, project, false, "", scopes)
if isMissingADCErr(err) {
    return fmt.Errorf("authenticate first: run 'gcloud auth application-default login' or set GOOGLE_APPLICATION_CREDENTIALS: %w", err)
}

When it happens

Trigger: Running initDataplexConnection with no `impersonateServiceAccount` configured and no credentials available: GOOGLE_APPLICATION_CREDENTIALS unset or pointing to a missing/invalid file, no `gcloud auth application-default login` performed locally, and no attached service account (not on GCE/GKE/Cloud Run), or the key file fails to parse for the requested scopes.

Common situations: Running the toolbox locally for the first time without authenticating; GOOGLE_APPLICATION_CREDENTIALS pointing at a deleted or malformed JSON key; Docker containers without the credential file mounted; GKE workloads without Workload Identity enabled; empty/stale gcloud credential store.

Related errors

• failed to find default credentials: %w
• failed to find default credentials: %w
• failed to find default Google Cloud credentials with scope %
• failed to find default Google Cloud credentials for project
• failed to find default Google Cloud credentials with scope %

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/97973830d3a907c2. Report an issue: GitHub.