kopia/kopia · error

unable to initialize token source

Error message

unable to initialize token source

What it means

CreateDriveService obtains an oauth2.TokenSource: from inline SA JSON, from a SA credentials file, or from google.DefaultTokenSource (Application Default Credentials). Any failure in this step — unreadable key, unparseable key, or no default credentials available — is wrapped as 'unable to initialize token source' and prevents creating the Drive client.

Solutions

1. Check the inner error in the wrapped chain to distinguish bad credentials (fix key JSON/path) from missing default credentials.
2. If not using a service account: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS to a valid SA key JSON.
3. If using a service account: verify the key file/JSON parses (see errors 1234-1236 fixes).
4. Confirm the Drive API is enabled in the credential's Google Cloud project.

Example fix

// before: no credentials anywhere
ctx := context.Background()
svc, err := gdrive.CreateDriveService(ctx, &gdrive.Options{FolderID: id})

// after: supply service-account credentials
svc, err := gdrive.CreateDriveService(ctx, &gdrive.Options{
    FolderID:                      id,
    ServiceAccountCredentialsFile: "/etc/kopia/gdrive-sa.json",
})

// ensure ADC is available when no SA credentials are configured
if saFile == "" && len(saJSON) == 0 && os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" {
    _, err := google.FindDefaultCredentials(ctx, drive.DriveFileScope)
    if err != nil {
        return errors.New("no credentials: run `gcloud auth application-default login` or set GOOGLE_APPLICATION_CREDENTIALS")
    }
}

if err != nil && strings.Contains(err.Error(), "unable to initialize token source") {
    // inspect the wrapped cause: bad key JSON vs no default credentials
}

When it happens

Trigger: Calling New/CreateDriveService when: no ServiceAccountCredentialJSON/File is configured and GOOGLE_APPLICATION_CREDENTIALS is unset with no gcloud ADC present; or the configured credential path/JSON is unreadable/invalid (the underlying cause is errors 1234-1236).

Common situations: Running locally without `gcloud auth application-default login`, containers missing GOOGLE_APPLICATION_CREDENTIALS, wrong service-account key content, or metadata-server unreachable on GCP.

Related errors

• error reading credentials file
• google.JWTConfigFromJSON
• get about in GetCapacity()
• unable to open service account credentials file
• Access denied.

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/b50a7f0634e5f92d. Report an issue: GitHub.

Appendix: source

Thrown at repo/blob/gdrive/gdrive_storage.go:530

	var err error

	var ts oauth2.TokenSource

	scope := drive.DriveFileScope
	if opt.ReadOnly {
		scope = drive.DriveReadonlyScope
	}

	if sa := opt.ServiceAccountCredentialJSON; len(sa) > 0 {
		ts, err = tokenSourceFromCredentialsJSON(ctx, sa, scope)
	} else if sa := opt.ServiceAccountCredentialsFile; sa != "" {
		ts, err = tokenSourceFromCredentialsFile(ctx, sa, scope)
	} else {
		ts, err = google.DefaultTokenSource(ctx, scope)
	}

	if err != nil {
		return nil, errors.Wrap(err, "unable to initialize token source")
	}

	hc := oauth2.NewClient(ctx, ts)

	service, err := drive.NewService(ctx, option.WithHTTPClient(hc))
	if err != nil {
		return nil, errors.Wrap(err, "unable to create Drive client")
	}

	return service, nil
}

// New creates new Google Drive-backed storage with specified options:
//
// - the 'folderID' field is required and all other parameters are optional.
//
// By default the connection reuses credentials managed by (https://cloud.google.com/sdk/),
// but this can be disabled by setting IgnoreDefaultCredentials to true.

View on GitHub (pinned to 82495e54b5)