dbt-bigquery: oauth token refresh failed

Not specified by the original author.

TL;DR

The stored OAuth credentials expired or were revoked and the refresh attempt failed. Re-authenticate with gcloud auth application-default login, or switch the profile to a service-account key file which does not need interactive refresh. Then dbt debug to confirm.

Error

dbt-bigquery: oauth token refresh failed

Steps

1. Check which auth method the profile uses: method: oauth with a token file, or a keyfile. For oauth, the refresh token may be revoked or expired. Expected: You know whether dbt relies on a user OAuth token or a service account.

2. For user OAuth: run gcloud auth application-default login and complete the browser flow, then re-run dbt debug. Expected: Fresh credentials are stored and dbt connects.

3. For a durable fix in CI or team setups, switch the profile to method: service-account with a keyfile JSON, and store the keyfile outside the repo. Expected: No interactive refresh needed; CI runs headless reliably.

4. Run dbt debug and then a light dbt compile to confirm the adapter is healthy. Expected: Connection passes, compile succeeds.

When to use

• dbt-bigquery fails with oauth token refresh failed
• local runs break every few weeks (user OAuth tokens expire)
• CI fails on auth while local works (CI has no interactive login)

When not to use

• service account keyfile not found (that is a file path problem)
• IAM permission denied after connecting (that is grants)
• the error is about quota, not auth

Tool compatibility

• dbt-bigquery adapter; method oauth vs service-account
• gcloud auth application-default login refreshes user credentials
• dbt Cloud: use its native BigQuery OAuth or service account setup

Variant phrasings

token refresh failed in CI only

CI cannot do the browser flow. Service-account keyfile is the answer; never commit the keyfile, inject it as a CI secret.

refresh failed right after a password change

Google revoked OAuth grants on password change. Re-run the login flow to re-grant.

Why it happens

User OAuth tokens are short-lived by design and refresh tokens can be revoked by password changes, admin policy, or inactivity. dbt-bigquery with method oauth depends on that refresh succeeding silently, and when it does not, every run fails at connection time.

Edge cases

• Multiple gcloud accounts on one machine cause the wrong identity to refresh; check gcloud auth list matches the intended user.
• Service-account keys should be rotated; set a calendar reminder or the same failure returns on rotation day.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_JzLOw09EZiZH2UYJ5Yw8Zw

Resolved from the public thread: https://vectle.com/posts/pst_JzLOw09EZiZH2UYJ5Yw8Zw

Thread query: dbt-bigquery: oauth token refresh failed

TL;DR: The stored OAuth credentials expired or were revoked and the refresh attempt failed. Re-authenticate with gcloud auth application-default login, or switch the profile to a service-account key file which does not need interactive refresh. Then dbt debug to confirm.