grpc/grpc-java · error · GrpcServiceParseException

Failed to parse access token credentials: " + e.getMessage()

Error message

Failed to parse access token credentials: " + e.getMessage()

What it means

GrpcServiceParseException thrown when the access-token credentials embedded in an xDS cluster/CDS security configuration cannot be parsed as protobuf (InvalidProtocolBufferException). The library wraps the raw protobuf error because the token credential payload is part of a resource received from the control plane, and an unparseable payload means the resource is invalid and the service cannot be constructed.

Source

Thrown at xds/src/main/java/io/grpc/xds/GrpcServiceConfigParser.java:265

        return parsed.get();
      }
    }
    throw new GrpcServiceParseException("No valid supported channel_credentials found");
  }

  private static Optional<CallCredentials> callCredsFromProto(Any cred)
      throws GrpcServiceParseException {
    if (cred.is(AccessTokenCredentials.class)) {
      try {
        AccessTokenCredentials accessToken = cred.unpack(AccessTokenCredentials.class);
        if (accessToken.getToken().isEmpty()) {
          throw new GrpcServiceParseException("Missing or empty access token in call credentials.");
        }
        return Optional
            .of(new SecurityAwareAccessTokenCredentials(MoreCallCredentials.from(OAuth2Credentials
                .create(new AccessToken(accessToken.getToken(), new Date(Long.MAX_VALUE))))));
      } catch (InvalidProtocolBufferException e) {
        throw new GrpcServiceParseException(
            "Failed to parse access token credentials: " + e.getMessage());
      }
    }
    return Optional.empty();
  }

  private static Optional<CallCredentials> extractCallCredentials(List<Any> callCredentialPlugins)
      throws GrpcServiceParseException {
    List<CallCredentials> creds = new ArrayList<>();
    for (Any cred : callCredentialPlugins) {
      Optional<CallCredentials> parsed = callCredsFromProto(cred);
      if (parsed.isPresent()) {
        creds.add(parsed.get());
      }
    }
    return creds.stream().reduce(CompositeCallCredentials::new);
  }

View on GitHub (pinned to 64daddc1f3)

Solutions

Inspect the xDS resource (CDS/cluster security configuration) on the control plane and fix the access-token credentials payload so it marshals the expected proto
Upgrade/downgrade the control plane or grpc-java so both sides agree on the expected credential proto version
Enable xDS client debug logging to capture the offending resource and its typeUrl
Validate the resource JSON/YAML with protoc before deploying it to the management server

Example fix

// before: sending call credentials as raw bytes in the cluster security config
Any.newBuilder().setValue(authTokenBytes).build()
// after: pack the correct message type
Any.pack(TokenCredentials.newBuilder().setToken(authToken).build())

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-parse check before relying on xDS-delivered credentials
if (anyCredential == null || anyCredential.getValue().isEmpty()) {
  throw new IllegalArgumentException("call credentials payload is empty");
}

Try / catch

try {
  ...buildService(...);
} catch (GrpcServiceParseException e) {
  if (e.getMessage().contains("Failed to parse access token credentials")) {
    // fall back to locally supplied credentials or alert on control-plane config
    logger.log(Level.SEVERE, "Invalid xDS token credentials", e);
  } else { throw e; }
}

Prevention

Keep control-plane and grpc-xds proto versions in sync
Validate xDS resources (CDS) with protoc/envoy validate before publishing
Never hand-craft Any payloads; use Any.pack() with the correct message type
Pin ADS server versions in staging before rolling to production

When it happens

Trigger: callCredsFromProto (invoked from `parsed`) receives a call-credentials Any/marshaled bytes whose contents do not match the expected message; the control plane sent malformed or mismatched token-credential bytes.

Common situations: Control plane (e.g. Istio/Envoy ADS server) sends a security config whose callCredentials typed config doesn't match the proto the client expects; version skew between control plane and grpc-xds; hand-edited or corrupted bootstrap/CDS responses.

Understand the failure class

Background: "cannot parse invalid wire-format data", "cannot unmarshal", "failed unmarshalling": protobuf unmarshal errors explained — this error's family across 10 libraries.

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/85e97e7ab4aa469d. Report an issue: GitHub.