prestodb/presto · error · UncheckedIOException

Failed to create Credentials from key

Error message

Failed to create Credentials from key

What it means

BigQueryCredentialsSupplier decodes a base64 service-account key and parses it into Google Credentials via GoogleCredentials.fromStream. If parsing fails with an IOException (malformed JSON, not a valid key, or invalid base64 producing garbage), it throws UncheckedIOException with 'Failed to create Credentials from key'. This is a credential configuration problem, not a network issue.

Source

Thrown at presto-bigquery/src/main/java/com/facebook/presto/plugin/bigquery/BigQueryCredentialsSupplier.java:52

    public BigQueryCredentialsSupplier(Optional<String> credentialsKey, Optional<String> credentialsFile)
    {
        // lazy creation, cache once it's created
        this.credentialsCreator = Suppliers.memoize(() -> {
            Optional<Credentials> credentialsFromKey = credentialsKey.map(BigQueryCredentialsSupplier::createCredentialsFromKey);
            Optional<Credentials> credentialsFromFile = credentialsFile.map(BigQueryCredentialsSupplier::createCredentialsFromFile);
            return Stream.of(credentialsFromKey, credentialsFromFile)
                    .flatMap(Streams::stream)
                    .findFirst();
        });
    }

    private static Credentials createCredentialsFromKey(String key)
    {
        try {
            return GoogleCredentials.fromStream(new ByteArrayInputStream(Base64.decodeBase64(key)));
        }
        catch (IOException e) {
            throw new UncheckedIOException("Failed to create Credentials from key", e);
        }
    }

    private static Credentials createCredentialsFromFile(String file)
    {
        try {
            return GoogleCredentials.fromStream(new FileInputStream(file));
        }
        catch (IOException e) {
            throw new UncheckedIOException("Failed to create Credentials from file", e);
        }
    }

    Optional<Credentials> getCredentials()
    {
        return credentialsCreator.get();
    }
}

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the key: base64 -w0 service-account.json and put that single-line output into bigquery.credentials-key
2. Alternatively use bigquery.credentials-key-file pointing directly to the JSON key file to avoid encoding issues
3. Confirm the key file is a valid service-account JSON (try gcloud auth activate-service-account --key-file=...)
4. Re-create the key in GCP console if the file is truncated or the key was deleted

Example fix

// before
credentials-key=eyJ...<truncated or raw JSON>
// after
base64 -w0 sa-key.json  # then use that output
credentials-key=<full valid base64 of sa-key.json>

// Validate the base64 key before configuring:
import org.apache.commons.codec.binary.Base64;
String decoded = new String(Base64.decodeBase64(key), StandardCharsets.UTF_8);
if (!decoded.trim().startsWith("{")) {
    throw new IllegalArgumentException("credentials-key must be base64 of a service-account JSON file");
}

try {
    Supplier<Credentials> supplier = ...; // build BigQueryCredentialsSupplier
} catch (UncheckedIOException e) {
    if (e.getMessage().contains("Failed to create Credentials from key")) {
        // fix bigquery.credentials-key: re-encode the key file with `base64 -w0 key.json`
    } else {
        throw e;
    }
}

When it happens

Trigger: Configuring bigquery.credentials-key with a value that is not valid base64 or not a valid service-account JSON/P12 key file content; e.g. passing the raw JSON file path instead of the base64 of the file, or a truncated/copied-wrongly key.

Common situations: Copy-pasting the JSON key itself instead of base64-encoding the key file; expired/deleted service account key; using the wrong property (key vs key-file) so a path string gets base64-decoded; whitespace/newlines corrupting the encoded value.

Related errors

• UNEXPECTED_ACCUMULO_ERROR
• Failed to create Credentials from file
• NOT_SUPPORTED
• Illegal character ':' found in username
• Error creating an instance of %s for URI %s

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/e77f84f67e600479. Report an issue: GitHub.