Could not load the default credentials? (Node.js Google Compute Engine tutorial)

Question

SITUATION:

I follow this tutorial: https://cloud.google.com/nodejs/tutorials/bookshelf-on-compute-engine

Everything works fine until I do npm start and go to:

I am met with the following text on the blank page:

Could not load the default credentials. Browse to https://developers.google.com/accounts/docs/application-default-credentials for more information.

Which makes no sense since I am using OAuth. I followed the link and read the page, but I have no GOOGLE-APPLICATION-CREDENTIALS field anywhere, and nothing about it in the tutorial.

QUESTION:

Could you please reproduce the steps and tell me if you get the same result ?

(takes 5 minutes)

If not, what could I have done wrong ?

If you are here as a result of the same issue but with Firebase: [See this Question](https://stackoverflow.com/questions/58127896/error-could-not-load-the-default-credentials-firebase-function-to-firestore) — Favour Felix Chinemerem, Jun 12 '20 at 18:33

score 245 · Accepted Answer · edited Oct 15 '19 at 03:41

245

Yes, I had the same error. It's annoying cause Google Cloud Platform docs for their "getting started" bookshelf tutorial does not mention this anywhere. Which means that any new developer who tries this tutorial will see this error.

Read this: https://developers.google.com/identity/protocols/application-default-credentials

I fixed this issue by running: gcloud auth application-default login

In order to run thisgcloud auth application-default login Visit: https://cloud.google.com/sdk/install 1) You have to install sdk into your computer 2) That will enable you to run the code 3) Log in to your associated gmail account then you are good to go!

This will make you login, and after that you code locally will use that authentication.

edited Oct 15 '19 at 03:41

Waynerbee

3
2

answered Feb 06 '17 at 02:41

newbreedofgeek

3,106
1
19
17

I did that, and the message is now: `The project projectName does not exist or it does not contain an active App Engine application. Please visit http://console.developers.google.com to create a project or https://console.developers.google.com/appengine?project=projectName to add an App Engine application. Note that the app must not be disabled.` THIS MAKES NO SENSE, I AM USING THE COMPUTE ENGINE AND THIS IS A TUTORIAL FOR THE COMPUTE ENGINE :( – Coder1000 Feb 06 '17 at 11:11
6

To use the gloud CLI for these tutorials you need to configure your default app in the CLI level. You may have missed this step. I'm sure you have already created a "Project" in GCP, take that ProjectID and run this: `gcloud config set project [YOUR_PROJECT_ID]`. This will configure your gloud CLI to use the correct Project. Check out: https://cloud.google.com/nodejs/getting-started/tutorial-app – newbreedofgeek Feb 06 '17 at 22:10
26

Setting process.env.GOOGLE_APPLICATION_CREDENTIALS = "" worked for me. – Gabriel Wamunyu Dec 24 '17 at 05:08
1

@newbreedofgeek 'gcloud' is not recognized as an internal or external command, operable program or batch file. – Sep 02 '19 at 15:01
1

@Coder1000 After installing the SDK and setting up GOOGLE_APPLICATION_CREDENTIALS it works for me. But how is this supposed to work in production? How do we retrieve the credentials in production? – rodbs Nov 04 '20 at 13:37
1

@GabrielWamunyu Does it work for you w/o the SDK? in production? – rodbs Nov 04 '20 at 13:37
@newbreedofgeek how do we make this credentials work on production? I have tried giving IAM bucket access to my service account but still it is not working. Do you any idea? – Saroj Maharjan Jan 29 '21 at 04:11
@newbreedofgeek how to solve this issue if it's appearing in the bitbucket pipelines? – AliOz Jun 23 '22 at 10:40
@GabrielWamunyu don't use service account files in production, they are easy to download breaching your whole environment. – Oliver Dixon Dec 07 '22 at 11:24

Caner · Answer 2 · 2018-02-01T08:10:59.027

There are 2 solutions for this problem. One option, as mentioned by others, is to use gcloud auth application-default login

Second option is to set the environment variable GOOGLE_APPLICATION_CREDENTIALS. It should point to a file that defines the credentials. To get this file you need to follow these steps:

Go to the API Console Credentials page.

From the project drop-down, select your project.

On the Credentials page, select the Create credentials drop-down, then select Service account key.

From the Service account drop-down, select an existing service account or create a new one.

For Key type, select the JSON key option, then select Create. The file automatically downloads to your computer.

Put the *.json file you just downloaded in a directory of your choosing.

This directory must be private (you can't let anyone get access to this), but accessible to your web server code.

Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the JSON file downloaded.

See https://developers.google.com/identity/protocols/application-default-credentials for details

Just want to say thanks. This one works for me (using Node.js). — Leo, Mar 08 '18 at 14:51
the path should be like `C:\Users\CheeWei.Choy\Desktop\OCR\Google-Vision-Api` or just `Google-Vision-Api.json` @Caner — , Sep 02 '19 at 15:04
You can choose the service account rule to be "reCAPTCHA Enterprise Agent" — Shalabyer, Jun 28 '23 at 00:58

Bira · Answer 3 · 2019-02-14T05:49:24.137

16

Create a service account key using and download the json file. https://console.cloud.google.com/apis/credentials/serviceaccountkey
Add this to your ENV file

GOOGLE_APPLICATION_CREDENTIALS = "<PATH_TO_SERVICE_ACCOUNT_JSON_FILE>"

E.g:

GOOGLE_APPLICATION_CREDENTIALS=/Users/hello/Documents/ssh/my-10ebbbc8b3df.json

edited Feb 14 '19 at 05:49

answered Jan 08 '19 at 06:48

Bira

4,531
2
27
42

1

how do we make this credentials work on production? – Saroj Maharjan Jan 29 '21 at 04:14
To use this in production you would do the same thing. You have a .ENV file in your project's directory and you make sure that the file path is still accurate-- pointing to the location of the JSON file-- when deployed. – ZachHappel Aug 05 '21 at 06:59
1

@ZachHappel that's bad practice. We shouldn't commit private keys in repo – GorvGoyl Nov 08 '21 at 13:09
How do you download the JSON file? There seem to be no buttons or links of any sorts (as of 2023) – InfiniteStack Oct 25 '22 at 23:22
dude, i just spent like 6 hours trying to fix this haha, thanks!! – Aaron Dec 06 '22 at 04:37

Tal · Answer 4 · 2021-10-23T09:13:13.820

15

I was facing the same issue. It got fixed with following command.

gcloud auth application-default login

It stores default gcloud cloud credentials on your system and uses the same.

edited Oct 23 '21 at 09:13

answered Oct 21 '21 at 05:48

Tal

1,091
12
25

score 9 · Answer 5 · answered Dec 08 '19 at 17:45

I got this error because of initially I did like below:

var admin = require("firebase-admin");
admin.initializeApp(); // I didnt add anything because firebaserc file include appName

It worked when I deployed the functions but not in serve. So this is how I solved it:

Go to the firebase Project settings(click on setting icon from side nav).
Click on the Service accounts.
Copy the admin sdk configuration snippet from selecting your pro. lang.

Ex (node.js):

var admin = require("firebase-admin");

var serviceAccount = require("path/to/serviceAccountKey.json");

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
  databaseURL: "https://your-domain.firebaseio.com"
});

Now we need to add serviceAccountKey.json file.
Click on the Manage service account permissions in top right corner.
Now, you will see services accounts for your project, in the table find the row with column name name and value firebase-adminsdk, in that row click on Action dots and select Create key.
From the pop up dialog select Key type as json and press create button.
You will prompt to download the file, download it to your functions directory in project(You can customize this as you want and if you pushing to github, make sure to ignore that file).
Now, if you save it into the same directory where you are initializeApp(), access that file like: ./socialape-15456-68dfdc857c55.json(In my case, both files are located: functions/index.js and functions/services.son in functions directory and in index.js file, I initialed my firebase admin sdk).

Ex(node.js):

const functions = require('firebase-functions');

var admin = require("firebase-admin");

var serviceAccount = require("./myapp-15456-68dfdc857c55.json");

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
  databaseURL: "https://myapp-15456.firebaseio.com"
});

It's a best and good idea to create .env file and include your file there and access it as others mentioned. I leave that part to you.

Hope this help someone on the planet. Regards!

Don't do this. The environment exposes an API to access the the security of the platform. — Oliver Dixon, Nov 04 '21 at 13:13
@OliverDixon can you please elaborate more on your comment and the right way to do this. — Blasanka, Nov 04 '21 at 14:56
https://stackoverflow.com/questions/56598069/nodejs-google-vision-is-unable-to-detect-a-project-id-in-the-current-environment/69840191#69840191 — Oliver Dixon, Nov 04 '21 at 15:47

score 7 · Answer 6 · answered Feb 07 '17 at 18:50

7

If you're running the app locally, then the gcloud beta auth application-default login command should suffice for acquiring local credentials (I updated the tutorial to say so).

When running the app on Google Compute Engine, if the Compute Engine instance was created with the proper scopes (cloud-platform should be sufficient) then the app will authenticate with Google Cloud Platform APIs automatically without any extra work on your part.

answered Feb 07 '17 at 18:50

jdobry

1,041
6
17

1

Thank you for your quick response. It's very nice to have such a quick official response from a Google engineer :) Sadly, I am faced with another issue in the tutorial, could you please have have a look at the following question: http://stackoverflow.com/questions/42098008/this-site-can-t-be-reached-compute-engine ? – Coder1000 Feb 07 '17 at 19:11
Also, you updated the wrong tutorial. That one is for the App Engine ? – Coder1000 Feb 10 '17 at 15:01
3

Difference between `gcloud beta auth application-default login` and `gcloud auth application-default login`? – basickarl May 31 '17 at 15:18

HMaziad · Answer 7 · 2019-09-06T14:06:45.377

5

Go here: https://firebase.google.com/docs/admin/setup#initialize_the_sdk and follow the instructions to create a private key. Then after you have downloaded your private key open command prompt in the project directory and do the following command:

 set GOOGLE_APPLICATION_CREDENTIALS=C:\YOUR-PATH\YOUR-KEY.json

edited Sep 06 '19 at 14:06

answered Sep 05 '19 at 13:15

HMaziad

189
2
5

Really bad advice. Service account files are easy to download from production images over the internet; this will breach your whole GCP account. – Oliver Dixon Dec 07 '22 at 11:25

score 4 · Answer 8 · answered Sep 05 '19 at 07:21

4

use this to solve your issue. this actually works:- just put credential parameter and give reference to your key to it.

const serviceAccount = require('../key.json');
admin.initializeApp({
    credential: admin.credential.cert(serviceAccount)
});

answered Sep 05 '19 at 07:21

Maitraiya Mali

99
4

perfect for unit/integration testing ! – Xavier D Mar 28 '23 at 20:47

score 3 · Answer 9 · edited Sep 09 '20 at 14:21

You have to create an object of your SessionsClient. Here I will provide some steps, so you can run your code like a charm.

You have to go into your Dialogflow dashboard.
Click on setting ( Left navbar top-right gear icon)
in the General tab click Service Account link ( it will redirect you to another screen)
If you have a service account then ignore step 5
Create a service account ( Top-center +icon button)
- Now you have a service account on a list click on
From the action, field presses the 3 vertical dots and create a key.
Download the JSON file on your local computer.
Assign object to your sessionClient.

const sessionClient = new dialogflow.SessionsClient({
 keyFilename: "/var/www/html/moqatrips/dialog-flow.json"
});

This is incorrect and introduces a security issue to the project; not to mention issues with deploying to multiple environments. Don't use service account files. Always use environmental apis. — Oliver Dixon, Nov 04 '21 at 13:11

score 2 · Answer 10 · answered Jul 03 '20 at 20:33

For all people using firebase, what it worked for me was passing the credentials to the KeyManagementServiceClient constructor

const serviceAccount = require('../keys/file.json'); //<- your firebase credentials
const client = new KeyManagementServiceClient({
      credentials: serviceAccount,
    });

score 2 · Answer 11 · answered Aug 07 '20 at 14:05

2

Another solution i found: in your package.json add an export command like this:

"scripts": {
    "start": "export GOOGLE_APPLICATION_CREDENTIALS='./gcloud.json' && node ./bin/www --exec babel-node --presets babel-preset-env",
  },

answered Aug 07 '20 at 14:05

Lê Vũ Huy

714
6
16

score 1 · Answer 12 · answered Jan 27 '20 at 18:35

I also had this error problem, here I had not created the object of

keyFilename (stores the credentials of the api)

in the sessionClient object for nodejs app.

const sessionClient = new dialogflow.SessionsClient({
                keyFilename: "./keyCredentials.json"  
       });
        
           const sessionPath = sessionClient.sessionPath(projectId, sessionId);

To download 'keyCredentials.json' goto:

https://console.cloud.google.com/apis/credentials/serviceaccountkey

Also add the path of this file to the system variables

In windows open powershell
type GOOGLE_APPLICATION_CREDENTIALS = [PATH_TO_SERVICE_ACCOUNT_JSON_FILE]

score 1 · Answer 13 · answered Dec 02 '20 at 19:55

you may find youself in another part of the world -- and land here. I'm adding to a three year old question because its keywords matched my issue and the preceding answers helped me although none describe my issue

firebase deploy --only functions --debug

produced

[2020-12-02T08:31:50.397Z] FirebaseError: HTTP Error: 429, Unknown Error
Error: Could not read source directory. Remove links and shortcuts and try again.

I could not find anything wrong with the source directory. But that was all so many tiny fish.

Examining the error in detail, from the top, lead to:

Our systems have detected unusual traffic from your computer network.  This page checks to see if it&#39;s really you sending the requests, and not a robot. 
The block will expire shortly after those requests stop.

Out of curiosity and exhaustion, I waited first. The wait reset duration is > than 30 minutes. So i pursued the captcha to prove my enduring humanity which did register eventually after some oauth warnings.

score 1 · Answer 14 · answered Jun 04 '21 at 12:08

1

download Cloud SDK installer from this site. https://cloud.google.com/sdk/docs/install
run this command -> gcloud auth application-default login

answered Jun 04 '21 at 12:08

praveen

11
3

score 0 · Answer 15 · answered May 19 '20 at 09:19

Although this question has been answered multiple times, I found myself in a situation not explained here.

After I created the variable: $GOOGLE_APPLICATION_CREDENTIALS, I was getting the same error as Coder1000.

However, I was running both: nodemon and: npm run dev in two separate sessions in Terminal, neither of which were aware of the variable.

Once I: shut the tabs down; added new tabs; and ran the commands again, the application was able to access the variable.

score 0 · Answer 16 · answered Oct 14 '21 at 15:10

If anyone ran into the issue just like me and doesn't want to set the variable each time before running their code it's best to manually set the environment variable. Name it GOOGLE_APPLICATION_CREDENTIALS and browse the downloaded JSON file. If you don't know the steps follow this: https://docs.oracle.com/en/database/oracle/machine-learning/oml4r/1.5.1/oread/creating-and-modifying-environment-variables-on-windows.html#GUID-DD6F9982-60D5-48F6-8270-A27EC53807D0

score 0 · Answer 17 · answered Aug 03 '23 at 08:02

0

You may use 2 options to initialize Storage with the dynamic key:

new Storage({credentials: {%_json_content_%})


new Storage({keyFilename: {%_json_path_%})

answered Aug 03 '23 at 08:02

Kurolesik

11
3

score 0 · Answer 18 · answered Aug 21 '23 at 23:44

0

e.g: we can use the credentials object like below:

  new PubSub({
    projectId: process.env.PROJECT_ID,
    credentials: {
      client_email: process.env.CLIENT_EMAIL,
      private_key: process.env.PRIVATE_KEY,
    },
  }

answered Aug 21 '23 at 23:44

kollein

328
3
10

Could not load the default credentials? (Node.js Google Compute Engine tutorial)

18 Answers18

Linked