infiniflow/ragflow · error · PermissionError

Unable to access {source} - service account credentials are

Error message

Unable to access {source} - service account credentials are invalid.

What it means

Error "Unable to access {source} - service account credentials are invalid." thrown in infiniflow/ragflow.

Source

Thrown at common/data_source/google_util/auth.py:119

                    oauth_creds_json_str = oauth_creds.to_json()

                new_creds_dict = {
                    DB_CREDENTIALS_DICT_TOKEN_KEY: oauth_creds_json_str,
                    DB_CREDENTIALS_PRIMARY_ADMIN_KEY: credentials[DB_CREDENTIALS_PRIMARY_ADMIN_KEY],
                    DB_CREDENTIALS_AUTHENTICATION_METHOD: authentication_method,
                }
    elif DB_CREDENTIALS_DICT_SERVICE_ACCOUNT_KEY in credentials:
        # SERVICE ACCOUNT
        service_account_key_json_str = credentials[DB_CREDENTIALS_DICT_SERVICE_ACCOUNT_KEY]
        service_account_key = json.loads(service_account_key_json_str)

        service_creds = ServiceAccountCredentials.from_service_account_info(service_account_key, scopes=GOOGLE_SCOPES[source])

        if not service_creds.valid or not service_creds.expired:
            service_creds.refresh(Request())

        if not service_creds.valid:
            raise PermissionError(f"Unable to access {source} - service account credentials are invalid.")

    creds: ServiceAccountCredentials | OAuthCredentials | None = oauth_creds or service_creds
    if creds is None:
        raise PermissionError(f"Unable to access {source} - unknown credential structure.")

    return creds, new_creds_dict


def get_google_oauth_creds(token_json_str: str, source: DocumentSource) -> OAuthCredentials | None:
    """creds_json only needs to contain client_id, client_secret and refresh_token to
    refresh the creds.

    expiry and token are optional ... however, if passing in expiry, token
    should also be passed in or else we may not return any creds.
    (probably a sign we should refactor the function)
    """

    creds_json = json.loads(token_json_str)

View on GitHub (pinned to 554fb1133a)

Solutions

1. Verify the service account key JSON is valid and not deleted in Cloud Console.
2. Ensure the service account has access to the target resource.

Example fix

# Cloud Console: IAM > Service Accounts > create new key; share resources with the SA email

When it happens

Trigger: Thrown at common/data_source/google_util/auth.py:119 when the library encounters an invalid state.

Common situations: The service account key was deleted, the account disabled, or the resource not shared with it; fixing IAM access prevents this error.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/b3e52335014de89e. Report an issue: GitHub.