infiniflow/ragflow · error · ValueError

Credentials json missing primary admin key

Error message

Credentials json missing primary admin key

What it means

Error "Credentials json missing primary admin key" thrown in infiniflow/ragflow.

Source

Thrown at common/data_source/google_drive/connector.py:200

    @property
    def google_domain(self) -> str:
        if self._primary_admin_email is None:
            raise RuntimeError("Primary admin email missing, should not call this property before calling load_credentials")
        return self._primary_admin_email.split("@")[-1]

    @property
    def creds(self) -> OAuthCredentials | ServiceAccountCredentials:
        if self._creds is None:
            raise RuntimeError("Creds missing, should not call this property before calling load_credentials")
        return self._creds

    # TODO: ensure returned new_creds_dict is actually persisted when this is called?
    def load_credentials(self, credentials: dict[str, Any]) -> dict[str, Any] | None:
        try:
            self._primary_admin_email = credentials[DB_CREDENTIALS_PRIMARY_ADMIN_KEY]
        except KeyError:
            raise ValueError("Credentials json missing primary admin key")

        self._creds, new_creds_dict = get_google_creds(
            credentials=credentials,
            source=DocumentSource.GOOGLE_DRIVE,
        )

        # Service account connectors don't have a specific setting determining whether
        # to include "shared with me" for each user, so we default to true unless the connector
        # is in specific folders/drives mode. Note that shared files are only picked up during
        # the My Drive stage, so this does nothing if the connector is set to only index shared drives.
        if isinstance(self._creds, ServiceAccountCredentials) and not self.specific_requests_made:
            self.include_files_shared_with_me = True

        self._creds_dict = new_creds_dict
        self._all_drive_ids_cache = None

        return new_creds_dict

View on GitHub (pinned to 554fb1133a)

Solutions

1. Add the primary admin key to the service account credentials JSON.
2. Set DB_CREDENTIALS_PRIMARY_ADMIN_KEY and rebuild the credentials payload.

Example fix

credentials_json['primary_admin'] = 'admin@example.com'

When it happens

Trigger: Thrown at common/data_source/google_drive/connector.py:200 when the library encounters an invalid state.

Common situations: The Google Workspace credentials JSON lacks the primary admin entry required for domain-wide delegation; adding it prevents this error.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/8ba720db062b4d6a. Report an issue: GitHub.