🚨 GCP Error: 'Reauthentication required' — Cause, Fix, and Troubleshooting Guide

Overview

gcloud (and the client libraries) raise this when the OAuth session backing your credentials has expired and Google requires you to prove your identity again before new access tokens can be minted:

ERROR: (gcloud.compute.instances.list) There was a problem refreshing your
current auth tokens: ('invalid_grant: reauth related error (invalid_rapt)',
{'error': 'invalid_grant', 'error_subtype': 'invalid_rapt'})

Reauthentication required.
Please run:
  $ gcloud auth login

The trigger is almost always a session-length / reauthentication policy set at the Google Workspace or Cloud Identity org level. Interactive users just re-login, but the same policy silently breaks long-running CI jobs and automation that authenticate as a user rather than a service account.

Symptoms

• gcloud commands that worked an hour ago now fail with Reauthentication required or invalid_rapt.
• CI pipelines fail with Reauthentication failed. cannot prompt during non-interactive execution.
• Client libraries raise google.auth.exceptions.ReauthFailError.
• The problem recurs on a fixed cadence (every 1, 8, or 16 hours) matching an org session policy.

Common Root Causes

1. A Google session-control / reauth policy

Workspace admins can require reauthentication every N hours for Google Cloud CLI/SDK access. User credentials are force-expired on that schedule regardless of activity.

2. Automation is using user credentials, not a service account

gcloud auth login credentials (or a personal application_default_credentials.json) were used in CI. Non-interactive jobs cannot answer a reauth prompt, so they hard-fail.

3. Revoked or stale refresh token

The refresh token was revoked (password change, admin action, security key removed) and can no longer be refreshed silently.

How to Diagnose

All read-only. First confirm which identity and credential type is active.

# Which account, and is it a user or a service account?
gcloud auth list
gcloud config get-value account

# Is Application Default Credentials pointed at a user cred?
gcloud auth application-default print-access-token 2>&1 | head -5

# Inspect the ADC file type ("authorized_user" = user cred, the usual culprit)
cat "$(gcloud info --format='value(config.paths.global_config_dir)')"/application_default_credentials.json \
  | grep -o '"type": *"[a-z_]*"'

"type": "authorized_user" in an automated context is the tell-tale sign: user credentials are subject to reauth policy; service accounts are not.

Fixes

Interactive users — just reauthenticate:

gcloud auth login
# If ADC is what expired:
gcloud auth application-default login

CI / automation — stop using user credentials. Attach a service account (keyless is best via Workload Identity Federation) so no reauth policy applies:

# On GCP compute: rely on the attached service account (no key file at all)
gcloud auth list   # should show the VM/runner service account as ACTIVE

# Elsewhere: use Workload Identity Federation or, as a last resort, a key
gcloud auth activate-service-account \
  --key-file=/secrets/ci-deployer-key.json

Confirm the org policy if it keeps recurring. Ask your Workspace admin whether Google Cloud session control is set; the reauth interval there dictates how often user creds die.

What to Watch Out For

• Never bake gcloud auth login user credentials into pipelines — they are the root cause of the non-interactive variant of this error.
• Service accounts are exempt from user session-control policies; migrating automation to them removes the problem permanently.
• invalid_rapt specifically means the Reauth Proof Token is missing/expired — it is a reauth signal, not a broken IAM grant, so do not start editing IAM bindings.
• After gcloud auth application-default login, restart long-running local processes so they pick up the refreshed ADC.

Related

• GCP Error: ‘invalid_grant: Invalid JWT Signature’
• GCP Error: ‘Request is missing required authentication credential’ (401)
• GCP Error: ‘Request had insufficient authentication scopes’
• More in the GCP error guides.