🚨 GCP Error: 'Request is missing required authentication credential' — Cause, Fix, and Troubleshooting Guide

Overview

This is a 401 UNAUTHENTICATED, not a 403. Google could not identify who is calling at all — the request carried no usable credential (no OAuth token, no valid API key):

{
  "error": {
    "code": 401,
    "message": "Request is missing required authentication credential.
                Expected OAuth 2 access token, login cookie or other valid
                authentication credential. See
                https://developers.google.com/identity/sign-in/web/devconsole-project.",
    "status": "UNAUTHENTICATED"
  }
}

Contrast with a 403: a 403 means “I know who you are, but you’re not allowed.” A 401 means “I don’t know who you are.” The fix is always about providing a credential, never about IAM roles.

Symptoms

• Client libraries or curl calls to *.googleapis.com return HTTP 401 with UNAUTHENTICATED.
• Code runs locally (where you logged in) but 401s in a container/CI where no credential is mounted.
• A raw curl to a Google API without an Authorization: Bearer header fails.
• DefaultCredentialsError: Could not automatically determine credentials from the client libraries.

Common Root Causes

1. Application Default Credentials are not configured

The environment has no ADC — no GOOGLE_APPLICATION_CREDENTIALS, no gcloud auth application-default login, and no attached service account (off-GCP).

2. A raw HTTP request with no Authorization header

Hand-rolled REST/curl calls that never attach a bearer token.

3. Expired or empty token variable

An $(gcloud auth print-access-token) captured earlier has since expired, or the token env var is empty.

4. Wrong endpoint / API key expected

Some APIs (Maps, Translation basic) expect an API key; none was supplied.

How to Diagnose

All read-only.

# Is there any ADC in this environment?
gcloud auth application-default print-access-token 2>&1 | head -3

# Is GOOGLE_APPLICATION_CREDENTIALS set and does the file exist?
echo "${GOOGLE_APPLICATION_CREDENTIALS:-<unset>}"
[ -f "${GOOGLE_APPLICATION_CREDENTIALS:-/nonexistent}" ] && echo "key present" || echo "no key file"

# Reproduce with an explicit token to prove it's a credential problem
TOKEN=$(gcloud auth print-access-token)
curl -s -o /dev/null -w "%{http_code}\n" \
  -H "Authorization: Bearer ${TOKEN}" \
  "https://compute.googleapis.com/compute/v1/projects/acme-prod-platform/zones"

If the authenticated curl returns 200 while the app 401s, the app simply is not attaching a credential.

Fixes

Local dev — set up ADC:

gcloud auth application-default login

Containers / CI off-GCP — mount a credential:

export GOOGLE_APPLICATION_CREDENTIALS=/secrets/app-sa-key.json
# Better: Workload Identity Federation so no key file is needed

On GCP compute (GCE/GKE/Cloud Run) — use the attached service account. No key file: the client libraries read ADC from the metadata server automatically. Ensure a service account is attached to the resource.

Raw REST calls — attach the bearer token:

curl -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://<api>.googleapis.com/..."

What to Watch Out For

• 401 = no identity; 403 = identity present but unauthorized. Do not touch IAM bindings for a 401 — you will waste time.
• The client libraries follow the ADC search order: GOOGLE_APPLICATION_CREDENTIALS → gcloud ADC → attached service account. If all three are empty, you get this 401.
• Access tokens live ~1 hour; a token captured into a long-lived variable will start returning 401 once it expires — regenerate per request.
• Prefer Workload Identity Federation / attached service accounts over key files to avoid missing-credential gaps entirely.

Related

• GCP Error: ‘Request had insufficient authentication scopes’
• GCP Error: ‘PERMISSION_DENIED (403)’ Caller Does Not Have Permission
• GCP Error: ‘Reauthentication required’
• More in the GCP error guides.