pola-rs/polars · error · ImportError

google-auth must be installed to use `CredentialProviderGCP`

Error message

google-auth must be installed to use `CredentialProviderGCP`

What it means

CredentialProviderGCP._ensure_module_availability (py-polars/src/polars/io/cloud/credential_provider/_providers.py:583-588) checks importlib.util.find_spec('google.auth') and raises ImportError when the Python GCP credential provider is selected but google-auth is missing. google-auth is optional and powers application-default-credentials resolution on the Python side (e.g. CredentialProviderGCP's default path).

Source

Thrown at py-polars/src/polars/io/cloud/credential_provider/_providers.py:588

        creds.refresh(google.auth.transport.requests.Request())  # type: ignore[no-untyped-call, unused-ignore]

        return {"bearer_token": creds.token}, (  # type: ignore[dict-item]
            int(
                (
                    expiry.replace(tzinfo=zoneinfo.ZoneInfo("UTC"))
                    if expiry.tzinfo is None
                    else expiry
                ).timestamp()
            )
            if (expiry := creds.expiry) is not None
            else None
        )

    @classmethod
    def _ensure_module_availability(cls) -> None:
        if importlib.util.find_spec("google.auth") is None:
            msg = "google-auth must be installed to use `CredentialProviderGCP`"
            raise ImportError(msg)


class UserProvidedGCPToken(CredentialProvider):
    """User-provided GCP token in storage_options."""

    def __init__(self, token: str) -> None:
        self.token = token

    def __call__(self) -> CredentialProviderFunctionReturn:
        return {"bearer_token": self.token}, None


def _get_credentials_from_provider_expiry_aware(
    credential_provider: CredentialProviderFunction,
) -> dict[str, str] | None:
    if (
        isinstance(credential_provider, CredentialProviderAWS)
        and not credential_provider._can_use_as_provider()

View on GitHub (pinned to df599052da)

Solutions

1. pip install google-auth
2. Give the Rust side a direct credential: storage_options={'service_account': '/path/sa.json'}
3. Run gcloud auth application-default login so ADC is discoverable

Example fix

# before
lf = pl.scan_parquet("gs://bucket/f.parquet")  # ImportError
# after
# $ pip install google-auth
lf = pl.scan_parquet("gs://bucket/f.parquet")

import importlib.util

def require_google_auth() -> None:
    if importlib.util.find_spec("google.auth") is None:
        raise ImportError("pip install google-auth for gs:// access without an explicit token")

try:
    lf = pl.scan_parquet(url)
except ImportError as e:
    if "google-auth" in str(e):
        raise SystemExit("pip install google-auth (or set service_account in storage_options)") from e
    raise

When it happens

Trigger: pl.scan_parquet('gs://bucket/f.parquet') with no token/service_account in storage_options on an environment without google-auth and no natively-discoverable ADC; or explicit pl.CredentialProviderGCP().

Common situations: Slim containers without the GCP extra; local dev where gcloud ADC is not set up; dependency cleanups that removed a formerly transitive google-auth.

Related errors

• boto3 must be installed to use `CredentialProviderAWS`
• azure-identity must be installed to use `CredentialProviderA
• `fsspec` is required for `storage_options` argument
• unsupported: cannot combine token with {unhandled_key} in st
• the graphviz `dot` binary should be on your PATH.(If not ins

AI-assisted analysis of pola-rs/polars@df599052da (2026-08-16). Data as JSON: /api/errors/25fbe23314092eb4. Report an issue: GitHub.