This repository was archived by the owner on Mar 3, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Mar 3, 2026. It is now read-only.
"Could not load the default credentials" when using custom apiEndpoint with getSignedUrl. #2197
Description
Environment details
- OS: Ubuntu 22.04
- Node.js version: v18.15.0
- npm version: 9.5.0
@google-cloud/storageversion: 6.10.0
Steps to reproduce
Run the following code when using a storage emulator such as fake-gcs-server or firebase storage emulator:
import { Storage } from "@google-cloud/storage";
const storage = new Storage({
apiEndpoint: 'http://localhost:9199',
projectId: 'random-fake-proj-id',
useAuthWithCustomEndpoint: false,
});
const expiration = new Date();
const expirationSecs = 60 * 10; // 10 minutes
expiration.setSeconds(expirationSecs);
const options = {
version: "v4" as const,
action: "read" as const,
expires: expiration,
};
const [url] = await storage.bucket(BUCKET_NAME)
.file(path)
.getSignedUrl(options);
This will return the following error about credentials, even though the emulator doesn't use credentials, so they aren't needed to sign the URL:
Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started for more information.
at GoogleAuth.getApplicationDefaultAsync (/app/api/index.js:65733:15)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async GoogleAuth.getClient (/app/api/index.js:66050:20)
at async GoogleAuth.getCredentialsAsync (/app/api/index.js:66009:24)
at async sign (/app/api/index.js:93784:33)
This was previously mentioned in a comment on this previous ticket: #1373 (comment)
Reacted by Alexander Nanberg, Michael Cousins and David Johnson
Activity
[-]"Could not load the default credentials" when using custom apiEndpoint with getSignedUrl.[/-][+]"Could not load the default credentials" when using custom apiEndpoint with `getSignedUrl.`[/+]ddelgrosso1 commentedon May 18, 2023
@danielbankhead I poked into this a bit and it appears that the problem comes in that there doesn't appear to be a way to tell the auth library to "faux" sign a request. Is there a clean way we can bypass this in storage when the user does not want to use authentication?
danielbankhead commentedon Jun 1, 2023
[discussed offline, sharing here] We may need to take a similar approach as googleapis/gcs-resumable-upload#416 for this issue.
BrennaEpp commentedon Nov 3, 2023
Hijacking this issue to track the implementation of this feature:
When a custom endpoint is set on the client, Sign URLs and Post Policies should automatically use that domain.
Optional: allow users to set a custom hostname for Sign URL and Post policy methods
See: go/signurl-custom-endpoint-gcs
danielbankhead commentedon Dec 13, 2023
Related: