gcloud auth application-default print-access-token error: "invalid_grant: Bad Request"

Question

I'm trying to do the tutorial for Google Cloud Speech. I did the first two steps successfully. The response from Step 2 is:

Activated service account credentials for: [my-service-account@cloud-speech-quickstart.iam.gserviceaccount.com]

The third step says:

3. Obtain an authorization token using your service account:

gcloud auth application-default print-access-token
access_token

I presume that this means, go to your CLI and enter:

gcloud auth application-default print-access-token

I get back this error message:

    ERROR: (gcloud.auth.application-default.print-access-token) There was a problem refreshing your current auth tokens: invalid_grant: Bad Request
Please run:

  $ gcloud auth login

to obtain new credentials, or if you have already logged in with a
different account:

  $ gcloud config set account ACCOUNT

to select an already authenticated account to use.

I presume this is telling me to go to the CLI and enter:

gcloud auth login

A webpage then opens that says:

Choose an account
to continue to Google Cloud SDK

I select my Google account and it goes to a screen that says:

Google Cloud SDK wants to
    View and manage your applications deployed on Google App Engine More info
    View and manage your Google Compute Engine resources    More info
    View and manage your data across Google Cloud Platform services More info
Allow Google Cloud SDK to do this?

I click Allow and it goes to a screen that says

You are now authenticated with the Google Cloud SDK!

However, the webpage doesn't give me an access token. Back on the command line I have this message:

You are now logged in as [[email protected]].
Your current project is [cloud-speech-quickstart].

That looks pretty good, but still no access token. If I re-enter

gcloud auth application-default print-access-token

I get the original error message. Is there any way to get out of this loop? Should I try gcloud auth revoke?

Answer 1

This just happened to me and it turns out I needed to do

gcloud auth application-default login

(and not gcloud auth login - this one no longer writes application-default credentials. the original error message is incorrect).

FWIW to use a service account for application-default credentials, I had to do GOOGLE_APPLICATION_CREDENTIALS=/path/to/service_account_key_file.json