tailscale/tailscale · error

gcp metadata returned empty token

Error message

gcp metadata returned empty token

What it means

acquireGCPMetadataIDToken read the identity endpoint body successfully but it was empty after trimming. The metadata server returned no JWT, usually because the instance has no service account or the audience is invalid.

Source

Thrown at wif/wif.go:244

	client := httpClient()
	resp, err := client.Do(req)
	if err != nil {
		return "", fmt.Errorf("call gcp metadata identity endpoint: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode/100 != 2 {
		b, _ := io.ReadAll(io.LimitReader(resp.Body, 2048))
		return "", fmt.Errorf("gcp metadata identity endpoint returned %s: %s", resp.Status, strings.TrimSpace(string(b)))
	}

	b, err := io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
	if err != nil {
		return "", fmt.Errorf("read gcp id token: %w", err)
	}
	jwt := strings.TrimSpace(string(b))
	if jwt == "" {
		return "", fmt.Errorf("gcp metadata returned empty token")
	}

	return jwt, nil
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Verify the VM's service account has an identity configured
2. Check the audience and format parameters, then retry

When it happens

Trigger: Thrown at wif/wif.go:244 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/2cd89724720bdc29. Report an issue: GitHub.