Cloud SDK "Reauthentication failed ... invalid_grant" in CI

gcloud tried to refresh its credentials and the identity provider rejected the grant. In non-interactive CI there is no way to complete an interactive reauth, so the command fails with invalid_grant or "Reauthentication failed".

What this error means

A gcloud command fails with "Reauthentication failed. cannot prompt during non-interactive execution" or "invalid_grant: Token has been expired or revoked", even though it worked earlier.

gcloud

ERROR: (gcloud.run.deploy) There was a problem refreshing your current auth tokens:
('invalid_grant: Token has been expired or revoked.', ...)
Please run: gcloud auth login

Common causes

A user credential expired or was revoked

CI authenticated with a user account whose refresh token expired or was revoked, so gcloud cannot get a new access token unattended.

A reauth policy requires interactive confirmation

Some org policies force periodic reauthentication, which cannot complete in a non-interactive runner.

How to fix it

Authenticate with a service account or Workload Identity

Stop using a personal user login for CI.
Authenticate with a service account key or, better, Workload Identity Federation.
Service identities do not trigger interactive reauth.

Terminal

gcloud auth activate-service-account \
  --key-file="$GOOGLE_APPLICATION_CREDENTIALS"

Use the official auth action with OIDC

Workload Identity Federation exchanges the CI OIDC token for short-lived Google credentials with no stored refresh token.

.github/workflows/ci.yml

- uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
    service_account: ci@my-project.iam.gserviceaccount.com

How to prevent it

Never authenticate CI with a personal user account.
Prefer Workload Identity Federation over stored keys.
Rotate service account keys and store them only in CI secrets.