googleworkspace/cli · error

No credentials found. Run `gws auth setup` to configure, `gw

Error message

No credentials found. Run `gws auth setup` to configure, `gws auth login` to authenticate, or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE.
Tip: Application Default Credentials (ADC) are also supported — run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS.

What it means

Terminal failure of the credential waterfall: no GOOGLE_WORKSPACE_CLI_TOKEN, no GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE, no encrypted credentials, no GOOGLE_APPLICATION_CREDENTIALS, and no well-known gcloud ADC file (~/.config/gcloud/application_default_credentials.json). The message enumerates every way to fix it, including the ADC tip.

Source

Thrown at crates/google-workspace-cli/src/auth.rs:428

            return parse_credential_file(&adc_path, &content).await;
        }
        anyhow::bail!(
            "GOOGLE_APPLICATION_CREDENTIALS points to {adc_env}, but file does not exist"
        );
    }

    // 4b. Well-known ADC path: ~/.config/gcloud/application_default_credentials.json
    // (populated by `gcloud auth application-default login`). Silent if absent.
    if let Some(well_known) = adc_well_known_path() {
        if well_known.exists() {
            let content = tokio::fs::read_to_string(&well_known)
                .await
                .with_context(|| format!("Failed to read ADC from {}", well_known.display()))?;
            return parse_credential_file(&well_known, &content).await;
        }
    }

    anyhow::bail!(
        "No credentials found. Run `gws auth setup` to configure, \
         `gws auth login` to authenticate, or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE.\n\
         Tip: Application Default Credentials (ADC) are also supported — run \
         `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS."
    )
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::io::Write;
    use tempfile::NamedTempFile;

    /// RAII guard that saves the current value of an environment variable and
    /// restores it when dropped. This ensures cleanup even if a test panics.
    struct EnvVarGuard {
        name: String,
        original: Option<std::ffi::OsString>,

View on GitHub (pinned to a3768d0e82)

Solutions

1. Interactive setup: `gws auth setup` (wizard) or `gws auth login` (browser OAuth)
2. Headless/CI: set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to a service-account or authorized-user JSON
3. Reuse gcloud: `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS
4. One-shot: export GOOGLE_WORKSPACE_CLI_TOKEN with a pre-obtained access token

// Preflight: fail fast with your own message before any API call
use anyhow::{Context, Result};

async fn ensure_credentials() -> Result<()> {
    if std::env::var_os("GOOGLE_WORKSPACE_CLI_TOKEN").is_some() { return Ok(()); }
    if let Ok(p) = std::env::var("GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE") {
        if std::path::Path::new(&p).is_file() { return Ok(()); }
    }
    if std::path::Path::new("~/.config/gws/.placeholder_expanded_manually").exists() { /* encrypted creds present check */ }
    anyhow::bail!("no credentials configured — run `gws auth login` first")
}

When it happens

Trigger: First run on a fresh machine/container before any `gws auth` command; HOME unset or redirected so ~/.config/gws does not exist; all auth env vars stripped in CI; encrypted credentials deleted by `gws auth logout` and never re-established.

Common situations: New developer cloning the repo; Docker/CI image with no mounted config and no env vars; running under a different user (sudo) whose HOME lacks ~/.config/gws; logout run to clear a bad state and forgotten.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• GOOGLE_APPLICATION_CREDENTIALS points to {adc_env}, but file
• Token refresh failed with status {}: {}
• Token response contained no access token
• GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE points to {path}, but
• OS keyring failed: {}. Set GOOGLE_WORKSPACE_CLI_KEYRING_BACK

AI-assisted analysis of googleworkspace/cli@a3768d0e82 (2026-08-16). Data as JSON: /api/errors/b98c2fabd9e4e583. Report an issue: GitHub.