infiniflow/ragflow · error · ConnectorValidationError

Failed to build BigQuery credentials: {exc}

Error message

Failed to build BigQuery credentials: {exc}

What it means

Raised when google.oauth2.service_account.Credentials.from_service_account_info throws while parsing the service account JSON — the JSON parsed fine (or was a dict) but is not a usable service account payload. Wrapped as ConnectorValidationError with the original exception chained.

Source

Thrown at common/data_source/bigquery_connector.py:183

        self._credentials = {"service_account_info": service_account_info}
        return None

    def _get_client(self):
        """Create and cache a BigQuery client from the loaded service account."""
        if self._client is not None:
            return self._client

        if bigquery is None or service_account is None:
            raise ConnectorValidationError("BigQuery client not installed. Please install google-cloud-bigquery.")

        service_account_info = self._credentials.get("service_account_info")
        if not service_account_info:
            raise ConnectorMissingCredentialError("BigQuery credentials not loaded.")

        try:
            creds = service_account.Credentials.from_service_account_info(service_account_info)
        except Exception as exc:
            raise ConnectorValidationError(f"Failed to build BigQuery credentials: {exc}")

        try:
            self._client = bigquery.Client(
                project=self.project_id or None,
                credentials=creds,
                location=self.location or None,
            )
        except Exception as exc:
            raise ConnectorValidationError(f"Failed to create BigQuery client: {exc}")

        return self._client

    # ------------------------------------------------------------------ #
    # Query construction
    # ------------------------------------------------------------------ #
    def _build_base_query(self) -> str:
        """Return the single base query (custom query takes precedence over table mode)."""
        if self.query:

View on GitHub (pinned to 554fb1133a)

Solutions

1. Re-download the real key JSON from GCP IAM (it must include type, project_id, private_key_id, private_key, client_email, client_id, token_uri) — never hand-write it
2. If the key passes through env vars/YAML, ensure embedded newlines in private_key survive ('\n' sequences intact)
3. Check exc.__cause__ — google-auth names the exact missing field
4. If you only have a workflow identity, use a different auth path; this connector requires a service account key

Example fix

# before: template with placeholder key
sa = {"project_id": "p", "client_email": "a@p.iam.gserviceaccount.com", "private_key": "REPLACE_ME"}

# after: use the actual downloaded key file contents
import json
sa = json.load(open("/secure/path/sa-key.json"))

REQUIRED_SA_FIELDS = {"type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "token_uri"}
def validate_sa_info(sa: dict) -> None:
    missing = REQUIRED_SA_FIELDS - sa.keys()
    if missing:
        raise ValueError(f"service account JSON missing fields: {sorted(missing)}")
    if "-----BEGIN PRIVATE KEY-----" not in sa["private_key"]:
        raise ValueError("private_key is malformed or a placeholder")

def looks_like_service_account(sa: dict) -> bool:
    return (
        isinstance(sa, dict)
        and sa.get("type") == "service_account"
        and "private_key" in sa
        and "client_email" in sa
        and "token_uri" in sa
    )

try:
    connector.validate_connector_settings()
except ConnectorValidationError as e:
    if "Failed to build BigQuery credentials" in str(e):
        raise ConfigError("service account JSON is not a real GCP key file") from e
    raise

When it happens

Trigger: The parsed service_account_info is missing required fields for google-auth (typically 'token_uri' or 'private_key'), contains a placeholder/private_key_id without a real private key, or the private_key PEM block is malformed/truncated.

Common situations: Hand-rolled or templated service account JSON with only project_id/client_email, a key whose private_key newlines were flattened to literal '\n' loss by a config system, or a workflow identity file mistaken for a service account key.

Related errors

• BigQuery: missing service_account_json
• BigQuery: service_account_json is not valid JSON: {exc}
• BigQuery: service_account_json must be a JSON string or obje
• main() must be defined or exported.
• main() returned a non-JSON-serializable value.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/2e8f926d40d59964. Report an issue: GitHub.