grpc/grpc-go · error

credentials: failed to create ID token credentials: %v

Error message

credentials: failed to create ID token credentials: %v

What it means

NewServiceAccountIdentityCredentials delegates to internal.NewIDTokenCredentials (idtoken.NewCredentials) and wraps any failure with this message (gcp_service_account_identity_credentials.go:106-109). The underlying %v is the idtoken library's error: the environment cannot source an ID token for the requested audience.

Source

Thrown at credentials/google/gcp_service_account_identity_credentials.go:108

// but rather a context that is valid for the entire lifetime of the
// credentials and should cancel the context when they are done.
//
// # Experimental
//
// Notice: This API is EXPERIMENTAL and may be changed or removed in a
// later release.
func NewServiceAccountIdentityCredentials(ctx context.Context, audience string) (credentials.PerRPCCredentials, error) {
	if ctx == nil {
		return nil, fmt.Errorf("credentials: ctx cannot be nil")
	}

	if audience == "" {
		return nil, fmt.Errorf("credentials: audience cannot be empty")
	}

	creds, err := internal.NewIDTokenCredentials(&idtoken.Options{Audience: audience})
	if err != nil {
		return nil, fmt.Errorf("credentials: failed to create ID token credentials: %v", err)
	}

	return &gcpServiceAccountIdentityCallCreds{
		ctx:      ctx,
		audience: audience,
		creds:    creds,
		backoff:  internal.BackoffStrategy,
	}, nil
}

// GetRequestMetadata gets the current request metadata, refreshing tokens if
// required. This implementation follows the PerRPCCredentials interface.
//
// It guarantees that only one underlying token fetch will be executed
// concurrently. If a valid token is cached, it is returned immediately. If
// a fetch recently failed, the cached error is returned until the backoff
// interval expires. Otherwise, it initiates a new token fetch or blocks
// waiting for an already-in-progress fetch to complete.

View on GitHub (pinned to 03255a9237)

Solutions

1. Run only on GCP (GCE/GKE/Cloud Run/etc.) where the metadata server can mint ID tokens for the VM service account.
2. Read the wrapped %v error to distinguish 'not on GCP' from 'service account unauthorized'.
3. Ensure the VM/Workload service account has the IAM roles/permissions needed to mint ID tokens.
4. If you must run off-GCP, use a JSON service-account key path with idtoken directly instead of this metadata-server-based credential.

Example fix

// before: metadata-server-based creds used off GCP
creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)

// after: only call this on GCP; guard the environment
if os.Getenv("KUBERNETES_SERVICE_HOST") == "" && !metadata.OnGCE() {
    log.Fatal("NewServiceAccountIdentityCredentials requires GCP")
}
creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)

// Guard the environment before using this GCP-only credential.
import "cloud.google.com/go/compute/metadata"

if !metadata.OnGCE() {
    return nil, errors.New("NewServiceAccountIdentityCredentials must run on GCP")
}
creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)

creds, err := google.NewServiceAccountIdentityCredentials(ctx, aud)
if err != nil {
    // err wraps the idtoken.NewCredentials failure; surface verbatim.
    return nil, fmt.Errorf("cannot construct ID token credentials: %w", err)
}

When it happens

Trigger: idtoken.NewCredentials fails because the host is not on GCP (no metadata server to mint an ID token for the default service account), the service account email cannot be resolved, credentials cannot be discovered via ADC, or the audience is malformed for the token type.

Common situations: Running this GCP-only credential on a developer laptop or non-GCP CI; a GCE VM whose service account lacks the iam.serviceAccounts.actAs permission; ADC pointing at a JSON key file that does not support ID tokens for the given audience; or an outdated cloud.google.com/go/auth/credentials/idtoken module.

Related errors

• credentials: ctx cannot be nil
• credentials: audience cannot be empty
• requires SecurityLevel %v; connection has %v
• credentials: cannot send secure credentials on an insecure c
• unsupported mode: %v

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/8b517638ee211c95. Report an issue: GitHub.