🚨 GCP Error: 'Request had insufficient authentication scopes' — Cause, Fix, and Troubleshooting Guide

Overview

This 403 means the access token presented is valid and the identity may even have the right IAM role — but the OAuth scopes attached to that token do not include the scope the target API requires:

{
  "error": {
    "code": 403,
    "message": "Request had insufficient authentication scopes.",
    "status": "PERMISSION_DENIED",
    "details": [{
      "@type": "type.googleapis.com/google.rpc.ErrorInfo",
      "reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT"
    }]
  }
}

Scopes are a token-level limit that sits in front of IAM. A token minted with a narrow scope (the classic Compute Engine default devstorage.read_only + a few others) cannot call APIs outside those scopes, even when the service account behind it is roles/owner.

Symptoms

• API calls fail with ACCESS_TOKEN_SCOPE_INSUFFICIENT while IAM looks correct.
• Code works locally (broad user scopes) but fails on a GCE VM or GKE node (narrow instance scopes).
• Reading a bucket works but writing fails, or Secret Manager/BigQuery calls fail specifically.
• gcloud auth print-access-token succeeds but a client-library call 403s.

Common Root Causes

1. GCE VM access scopes are too narrow

The instance was created with the default access scopes instead of cloud-platform. The VM’s metadata token is restricted regardless of the service account’s IAM roles.

2. Application Default Credentials created without the needed scope

gcloud auth application-default login without --scopes, or a library that requested only a read-only scope.

3. Impersonation / token exchange dropping scopes

Generating an access token via impersonation without passing the required scopes.

How to Diagnose

All read-only. Inspect the scopes actually granted to the token/instance.

# On a GCE VM: what scopes were baked into the instance?
gcloud compute instances describe my-vm \
  --zone=us-central1-a --project=acme-prod-platform \
  --format="value(serviceAccounts[].scopes)"

# Inspect the live token from the metadata server on the VM
curl -s -H "Metadata-Flavor: Google" \
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes"

# Validate any access token's granted scopes
gcloud auth print-access-token \
  | xargs -I{} curl -s "https://oauth2.googleapis.com/tokeninfo?access_token={}" \
  | grep -o '"scope": *"[^"]*"'

If the returned scopes lack https://www.googleapis.com/auth/cloud-platform (or the specific API scope), that is your root cause — not IAM.

Fixes

GCE VM — set the broad cloud-platform scope. Scopes can only be changed while the VM is stopped:

gcloud compute instances stop my-vm --zone=us-central1-a --project=acme-prod-platform
gcloud compute instances set-service-account my-vm \
  --zone=us-central1-a --project=acme-prod-platform \
  --service-account=app-runtime@acme-prod-platform.iam.gserviceaccount.com \
  --scopes=cloud-platform
gcloud compute instances start my-vm --zone=us-central1-a --project=acme-prod-platform

Application Default Credentials — request the scope:

gcloud auth application-default login \
  --scopes=https://www.googleapis.com/auth/cloud-platform

Prefer cloud-platform + IAM for real control. The Google-recommended pattern is to grant the broad cloud-platform scope and then restrict the identity with least-privilege IAM roles — scopes are a coarse legacy control.

What to Watch Out For

• Scopes are enforced before IAM: a roles/owner service account still 403s if the token scope is too narrow. Fix the scope, not the role.
• On GKE, node pools should run with the cloud-platform scope (Workload Identity handles the fine-grained per-pod authorization).
• Changing VM scopes requires a stop/start — plan the brief downtime.
• Do not confuse this with Request is missing required authentication credential (a 401, no token at all) or a plain missing-role 403.

Related

• GCP Error: ‘PERMISSION_DENIED (403)’ Caller Does Not Have Permission
• GCP Error: ‘Request is missing required authentication credential’ (401)
• GCP Error: ‘Reauthentication required’
• More in the GCP error guides.