com.google.cloud.datastore.DatastoreException: Request is missing required authentication credential

Question

I am using google app engine and google datastore. I am using the google library

com.google.cloud.datastore.Datastore

My sample code is:

Datastore datastore = DatastoreOptions.getDefaultInstance().getService();
Key taskKey = datastore.newKeyFactory().setKind(entityName).newKey(id);
//populate some fields....
datastore.put(task);

I am using spring-boot and jetty as a container.

On local, it is working properly and the data updated in the google datastore.

The issue is when im deploying the app to the google-app-engine, im getting the Below exception when i get to datastore.put method.

com.google.cloud.datastore.DatastoreException: Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.
com.google.cloud.datastore.spi.v1.HttpDatastoreRpc.translate(HttpDatastoreRpc.java:129)
com.google.cloud.datastore.spi.v1.HttpDatastoreRpc.commit(HttpDatastoreRpc.java:155)
com.google.cloud.datastore.DatastoreImpl$4.call(DatastoreImpl.java:485)

Note: in both, on local environment and google-app-engine, i defined the environment variable GOOGLE_APPLICATION_CREDENTIALS that point to json file with all required credentials generated by google API.

Answer 1

According to the documentation for connecting to Datastore from App Engine in Java , there are several options available, so you can either go with Objectify (third party library), Datastore API or Datastore Client Library .

With the usage of Client Libraries, you must know that they make use of the Application Default Credentials , in such a way that, as documented, if the environment variable GOOGLE_APPLICATION_CREDENTIALS , ADC uses the default service account that App Engine provides for applications running over that service. So in your case, I think you should not define the environment variable, so that App Engine uses its default Service Account.

Answer 2

if you still struggling with com.google.cloud.datastore.DatastoreException: Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. com.google.cloud.datastore.DatastoreException: Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. you can set credentials explicitly, like it is shown in the example below:

            Resource credentialsCyberpower = resourceLoader.getResource("classpath:yourservice-datastore-access.json");


            GoogleCredentials credentials = GoogleCredentials.fromStream(credentialsCyberpower.getInputStream())
                  .createScoped(Lists.newArrayList("https://www.googleapis.com/auth/cloud-platform"));
            DatastoreOptions options =
                    DatastoreOptions.newBuilder().setProjectId("XXXXXX").setCredentials(credentials).build();
            Datastore datastore = options.getService();
            ObjectifyService.init(new ObjectifyFactory(datastore));

generate yourservice-datastore-access.json in IAM service accounts. working with Objectify 6.0.5

Answer 3

If you are using <url-stream-handler>urlfetch</url-stream-handler> with Java8 and Objectify 6 you will have to switch into native and enable billing.

I was hit by this issue recently and spend a lot of time on fixing the problem, more info can be found here