prestodb/presto · error · UncheckedIOException

Failed to create Credentials from file

Error message

Failed to create Credentials from file

What it means

This error is thrown by BigQueryCredentialsSupplier.createCredentialsFromFile when the GoogleCredentials.fromStream call fails to parse or read the service-account key file. It means the configured bigquery.credentials-key file could not be turned into Google credentials, usually because the path is wrong, the file is unreadable, or the JSON is not a valid Google credentials file. The original IOException is preserved as the cause.

Source

Thrown at presto-bigquery/src/main/java/com/facebook/presto/plugin/bigquery/BigQueryCredentialsSupplier.java:62

    }

    private static Credentials createCredentialsFromKey(String key)
    {
        try {
            return GoogleCredentials.fromStream(new ByteArrayInputStream(Base64.decodeBase64(key)));
        }
        catch (IOException e) {
            throw new UncheckedIOException("Failed to create Credentials from key", e);
        }
    }

    private static Credentials createCredentialsFromFile(String file)
    {
        try {
            return GoogleCredentials.fromStream(new FileInputStream(file));
        }
        catch (IOException e) {
            throw new UncheckedIOException("Failed to create Credentials from file", e);
        }
    }

    Optional<Credentials> getCredentials()
    {
        return credentialsCreator.get();
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the credentials-key path in the catalog properties exists and is readable by the Presto process user
2. Validate the file is a complete Google service-account JSON (has client_email, private_key); re-download from GCP if truncated
3. If using a P12 file, supply bigquery.credentials-keyfile-password and confirm it is a P12 key, not JSON
4. Check file permissions (chmod 600 / correct ownership) and that the file is mounted/copied into the container image
5. Inspect the wrapped IOException cause in the log for the precise failure (No such file vs parse error)

Example fix

// before (broken path or bad JSON)
bigquery.credentials-key=/etc/secrets/sa.json
// after (verify file exists and is valid before start)
ls -l /etc/secrets/sa.json && python3 -c "import json;json.load(open('/etc/secrets/sa.json'))"
bigquery.credentials-key=/etc/secrets/sa.json

File key = Paths.get(config.get("bigquery.credentials-key")).toFile();
if (!key.isFile() || !key.canRead()) throw new IllegalStateException("credentials-key missing/unreadable: " + key);
com.google.gson.JsonObject o = com.google.gson.JsonParser.parseReader(new FileReader(key)).getAsJsonObject();
if (!o.has("client_email") || !o.has("private_key")) throw new IllegalStateException("not a service-account JSON key");

try {
    connectorContext.start();
} catch (UncheckedIOException e) {
    if (e.getMessage().contains("Failed to create Credentials from file")) {
        throw new PrestoException(INVALID_CONNECTOR_PROPERTIES, "Invalid bigquery.credentials-key: " + e.getCause().getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: GoogleCredentials.fromStream(new FileInputStream(file)) throws IOException: file path (bigquery.credentials-key) does not exist, FileInputStream fails, stream read fails, or the file content is not parseable as Google credentials JSON/P12.

Common situations: Typo in the credentials-key path in catalog properties; key file mounted at a different path in Docker/Kubernetes; service-account JSON truncated or replaced by a placeholder; wrong key type (e.g. user JSON exported elsewhere); file permissions preventing the Presto process from reading it.

Related errors

• Failed to create Credentials from key
• Error creating BigQueryReadClient
• BIGQUERY_ERROR_END_OF_AVRO_BUFFER
• BIGQUERY_ERROR_READING_NEXT_AVRO_RECORD
• NOT_SUPPORTED

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/3f170bc9c4befe6e. Report an issue: GitHub.