googleapis/mcp-toolbox · error

failed to get token from token source: %w

Error message

failed to get token from token source: %w

What it means

After locating default credentials, GetIAMAccessToken requests an OAuth2 token via creds.TokenSource.Token(). This error wraps any failure in that exchange — network problems reaching Google's OAuth endpoints, revoked or malformed credentials, or clock skew invalidating the grant. It means credentials were found but could not be exchanged for a valid token.

Source

Thrown at internal/sources/util.go:154

		return "", fmt.Errorf("unsupported dbType: %s. Use 'mysql' or 'postgres'", dbType)
	}

	if username == "" {
		return "", fmt.Errorf("username from ADC cannot be an empty string")
	}

	return username, nil
}

func GetIAMAccessToken(ctx context.Context) (string, error) {
	creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return "", fmt.Errorf("failed to find default credentials (run 'gcloud auth application-default login'?): %w", err)
	}

	token, err := creds.TokenSource.Token() // This gets an oauth2.Token
	if err != nil {
		return "", fmt.Errorf("failed to get token from token source: %w", err)
	}

	if !token.Valid() {
		return "", fmt.Errorf("retrieved token is invalid or expired")
	}
	return token.AccessToken, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Check network access to https://oauth2.googleapis.com (proxy/firewall/DNS)
2. Re-authenticate: 'gcloud auth application-default login' or download a fresh service account key
3. Sync system time (ntp/chrony) if the machine clock is skewed
4. Verify the service account is enabled and the key is not revoked in Cloud Console

Example fix

# before: stale/revoked credentials
# after: re-authenticate and retry
gcloud auth application-default login

// Pre-flight: verify the OAuth token endpoint is reachable
const res = await fetch("https://oauth2.googleapis.com/token", { method: "HEAD" }).catch(() => null);
if (!res) throw new Error("oauth2.googleapis.com unreachable: check proxy/firewall");

try {
  const token = await getIAMAccessToken(ctx);
} catch (err) {
  if (String(err).includes("failed to get token from token source")) {
    await backoffRetry(() => getIAMAccessToken(ctx), { retries: 3 }); // transient network failures
  }
  throw err;
}

When it happens

Trigger: Calling GetIAMAccessToken with credentials that exist but fail token exchange: revoked service account key, deleted user account, network/firewall blocking oauth2.googleapis.com, system clock far out of sync, or corrupted ADC key file.

Common situations: Corporate proxy/firewall blocking Google OAuth endpoints; a service account key that was deleted or disabled in Cloud Console after being downloaded; VM with significant clock drift; expired/invalid refresh token in gcloud ADC.

Related errors

• retrieved token is invalid or expired
• unable to connect successfully: %w
• unable to connect successfully: %w
• failed to create DataChatClient: %w
• failed to find default credentials: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/867c94b86ef9df07. Report an issue: GitHub.