infiniflow/ragflow · critical · ConnectorMissingCredentialError

Google Cloud Storage

Error message

Google Cloud Storage

What it means

For BlobType.GOOGLE_CLOUD_STORAGE, load_credentials requires both access_key_id and secret_access_key (S3-compatible GCS interoperability keys); missing either raises ConnectorMissingCredentialError('Google Cloud Storage').

Source

Thrown at common/data_source/blob_connector.py:107

            authentication_method = credentials.get("authentication_method", "access_key")

            if authentication_method == "access_key":
                if not all(credentials.get(key) for key in ["aws_access_key_id", "aws_secret_access_key"]):
                    raise ConnectorMissingCredentialError("Amazon S3")

            elif authentication_method == "iam_role":
                if not credentials.get("aws_role_arn"):
                    raise ConnectorMissingCredentialError("Amazon S3 IAM role ARN is required")

            elif authentication_method == "assume_role":
                pass

            else:
                raise ConnectorMissingCredentialError("Unsupported S3 authentication method")

        elif self.bucket_type == BlobType.GOOGLE_CLOUD_STORAGE:
            if not all(credentials.get(key) for key in ["access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Google Cloud Storage")

        elif self.bucket_type == BlobType.OCI_STORAGE:
            if not all(credentials.get(key) for key in ["namespace", "region", "access_key_id", "secret_access_key"]):
                raise ConnectorMissingCredentialError("Oracle Cloud Infrastructure")

        elif self.bucket_type == BlobType.S3_COMPATIBLE:
            if not all(credentials.get(key) for key in ["endpoint_url", "aws_access_key_id", "aws_secret_access_key", "addressing_style"]):
                raise ConnectorMissingCredentialError("S3 Compatible Storage")

        else:
            raise ValueError(f"Unsupported bucket type: {self.bucket_type}")

        # Create S3 client
        self.s3_client = create_s3_client(self.bucket_type, credentials, self.european_residency)

        # Detect bucket region (only important for S3)
        if self.bucket_type == BlobType.S3:
            self.bucket_region = detect_bucket_region(self.s3_client, self.bucket_name)

View on GitHub (pinned to 554fb1133a)

Solutions

  1. Create HMAC keys in GCP: Cloud Storage → Settings → Interoperability, and copy Access Key + Secret
  2. Supply them as access_key_id and secret_access_key exactly
  3. If you only have a service-account JSON, generate interoperability keys for that account first

Example fix

// before
creds = {"access_key_id": "GOOG..."}  # secret missing

// after
creds = {"access_key_id": "GOOG...", "secret_access_key": "bGbF..."}
Defensive patterns

Strategy: validation

Validate before calling

if not (creds.get("access_key_id") and creds.get("secret_access_key")):
    raise ValueError("GCS blob storage needs access_key_id and secret_access_key (HMAC interoperability keys)")

Type guard

def is_gcs_cred_dict(x) -> bool:
    """True when x carries both non-empty GCS interoperability keys."""
    return (
        isinstance(x, dict)
        and isinstance(x.get("access_key_id"), str) and x["access_key_id"].strip() != ""
        and isinstance(x.get("secret_access_key"), str) and x["secret_access_key"].strip() != ""
    )

Try / catch

try:
    blob.load_credentials(creds)
except ConnectorMissingCredentialError as e:
    if "Google Cloud Storage" in str(e):
        creds = create_gcs_hmac_keys_and_refill()  # Cloud Storage -> Settings -> Interoperability
        blob.load_credentials(creds)

Prevention

When it happens

Trigger: GCS connector config where access_key_id or secret_access_key is absent/empty during load_credentials.

Common situations: Users trying GCP service-account JSON instead of interoperability keys (the connector expects HMAC keys here); blank fields; key names copied from AWS style (aws_access_key_id) instead of GCS style.

Related errors

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/7464152164d4f41c. Report an issue: GitHub.