infiniflow/ragflow · error · PermissionError

Unable to access {source} - unknown credential structure.

Error message

Unable to access {source} - unknown credential structure.

What it means

Error "Unable to access {source} - unknown credential structure." thrown in infiniflow/ragflow.

Source

Thrown at common/data_source/google_util/auth.py:123

                    DB_CREDENTIALS_PRIMARY_ADMIN_KEY: credentials[DB_CREDENTIALS_PRIMARY_ADMIN_KEY],
                    DB_CREDENTIALS_AUTHENTICATION_METHOD: authentication_method,
                }
    elif DB_CREDENTIALS_DICT_SERVICE_ACCOUNT_KEY in credentials:
        # SERVICE ACCOUNT
        service_account_key_json_str = credentials[DB_CREDENTIALS_DICT_SERVICE_ACCOUNT_KEY]
        service_account_key = json.loads(service_account_key_json_str)

        service_creds = ServiceAccountCredentials.from_service_account_info(service_account_key, scopes=GOOGLE_SCOPES[source])

        if not service_creds.valid or not service_creds.expired:
            service_creds.refresh(Request())

        if not service_creds.valid:
            raise PermissionError(f"Unable to access {source} - service account credentials are invalid.")

    creds: ServiceAccountCredentials | OAuthCredentials | None = oauth_creds or service_creds
    if creds is None:
        raise PermissionError(f"Unable to access {source} - unknown credential structure.")

    return creds, new_creds_dict


def get_google_oauth_creds(token_json_str: str, source: DocumentSource) -> OAuthCredentials | None:
    """creds_json only needs to contain client_id, client_secret and refresh_token to
    refresh the creds.

    expiry and token are optional ... however, if passing in expiry, token
    should also be passed in or else we may not return any creds.
    (probably a sign we should refactor the function)
    """

    creds_json = json.loads(token_json_str)
    creds = OAuthCredentials.from_authorized_user_info(
        info=creds_json,
        scopes=GOOGLE_SCOPES[source],
    )

View on GitHub (pinned to 554fb1133a)

Solutions

1. Provide credentials in a supported format: service account JSON or OAuth tokens plus client config.

Example fix

# use either {'service_account_json': ...} or {'access_token':..., 'refresh_token':..., 'client_config':...}

When it happens

Trigger: Thrown at common/data_source/google_util/auth.py:123 when the library encounters an invalid state.

Common situations: The stored Google credential blob matches neither the service account nor OAuth shape; re-saving credentials in a supported format prevents this error.

AI-assisted analysis of infiniflow/ragflow@554fb1133a (2026-08-15). Data as JSON: /api/errors/792e215e03cbd606. Report an issue: GitHub.