mem0ai/mem0 · error · ValueError

No valid GCP credentials found. Please provide one of: 1. se

Error message

No valid GCP credentials found. Please provide one of:
1. service_account_json parameter (dict)
2. credentials_path parameter (file path)
3. GOOGLE_APPLICATION_CREDENTIALS environment variable
4. Default credentials (if running on GCP)
Error: {e}

What it means

Raised by GCPAuthenticator.get_credentials after all four credential strategies failed: (1) service_account_json dict, (2) credentials_path file, (3) GOOGLE_APPLICATION_CREDENTIALS env var, (4) google.auth.default() for GCE/Cloud Run/Workload Identity. The trailing 'Error: {e}' carries the underlying google.auth.default() exception, which usually names the real problem (no ADC file, metadata server unreachable, etc.).

Source

Thrown at mem0/utils/gcp_auth.py:81

        # Method 3: Environment variable path
        elif os.getenv("GOOGLE_APPLICATION_CREDENTIALS"):
            env_path = os.getenv("GOOGLE_APPLICATION_CREDENTIALS")
            if os.path.isfile(env_path):
                credentials = service_account.Credentials.from_service_account_file(
                    env_path, scopes=scopes
                )
                # Extract project_id from the file
                with open(env_path, 'r') as f:
                    cred_data = json.load(f)
                    project_id = cred_data.get("project_id")

        # Method 4: Default credentials (GCE, Cloud Run, etc.)
        if not credentials:
            try:
                credentials, project_id = default(scopes=scopes)
            except Exception as e:
                raise ValueError(
                    f"No valid GCP credentials found. Please provide one of:\n"
                    f"1. service_account_json parameter (dict)\n"
                    f"2. credentials_path parameter (file path)\n"
                    f"3. GOOGLE_APPLICATION_CREDENTIALS environment variable\n"
                    f"4. Default credentials (if running on GCP)\n"
                    f"Error: {e}"
                )

        return credentials, project_id

    @staticmethod
    def setup_vertex_ai(
        service_account_json: Optional[Dict[str, Any]] = None,
        credentials_path: Optional[str] = None,
        project_id: Optional[str] = None,
        location: str = "us-central1"
    ) -> str:
        """

View on GitHub (pinned to 001c235229)

Solutions

Run gcloud auth application-default login for local development
Or set GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json with a valid service account key
Or pass service_account_json=... / credentials_path=... directly in the provider config
On GCP compute, verify Workload Identity / attached service account is configured
Read the trailing 'Error:' text — it distinguishes missing file vs unreachable metadata server vs malformed key

Example fix

# before
memory = Memory.from_config({"embedder": {"provider": "vertexai", "config": {}}})
# ValueError: No valid GCP credentials found ...

# after
# gcloud auth application-default login
memory = Memory.from_config({"embedder": {"provider": "vertexai", "config": {}}})

Defensive patterns

Strategy: try-catch

Validate before calling

import os, pathlib
ADC = pathlib.Path.home() / '.config/gcloud/application_default_credentials.json'
def gcp_creds_likely_present():
    return bool(os.getenv('GOOGLE_APPLICATION_CREDENTIALS') or os.getenv('GCP_SERVICE_ACCOUNT_JSON') or ADC.exists())

Try / catch

try:
    creds, project = GCPAuthenticator.get_credentials(scopes=[...])
except ValueError as e:
    if 'No valid GCP credentials found' in str(e):
        raise ConfigError('run gcloud auth application-default login or set GOOGLE_APPLICATION_CREDENTIALS') from e
    raise

Prevention

Run gcloud auth application-default login as part of dev-machine setup
Pass service_account_json explicitly in production configs instead of relying on ADC
Add a startup health check that calls get_credentials once at boot
Alert on credential-expiry events for rotated service-account keys

When it happens

Trigger: Running locally with no service account JSON supplied and no GOOGLE_APPLICATION_CREDENTIALS set and ~/.config/gcloud/application_default_credentials.json absent; ADC pointing at a deleted/rotated key file; running outside GCP while assuming default credentials exist; blocked metadata server (169.254.169.254) causing google.auth.default() to time out.

Common situations: New developer machine without gcloud auth application-default login; CI runner lacking the secret mount; expired service account key; firewall/proxy blocking the GCE metadata endpoint; Workload Identity not configured on the GKE/EKS node.

Related errors

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/9a32954206f93130. Report an issue: GitHub.