google.auth.default() fails to retreive project_id

[uweber]

Determine this is the right repository

• I determined this is the correct repository in which to report this bug.

Summary of the issue

Context
google.auth.default() will use http.client as default transport, but mTLS support needs session support to work

Expected Behavior:
return proper project_id with default transport

Actual Behavior:
returned project_id is None

API client name and version

google-auth 2.49.0

Reproduction steps: code

file: main.py

import google.auth
credentials, project_id = google.auth.default()
assert(project_id)

Worked in 2.43.0 and broke with 2.44.0 and later due mTLS support, which has a hard requirement for requests.

Workaround:
file: main.py

import google.auth
from google.auth.transport.requests import Request
credentials, project_id = google.auth.default(request=Request())
assert(project_id)

Reproduction steps: supporting files

No response

Reproduction steps: actual results

No response

Reproduction steps: expected results

No response

OS & version + platform

Debian 12

Python environment

3.11.2

Python dependencies

No response

Additional context

No response

[daniel-sanche]

I was able to reproduce the issue:

2026-03-12 20:03:00,015 - google.auth._default - DEBUG - Checking '' for explicit credentials as part of auth process...
2026-03-12 20:03:00,016 - google.auth._default - DEBUG - Checking Cloud SDK credentials as part of auth process...
2026-03-12 20:03:00,016 - google.auth._default - DEBUG - Cloud SDK credentials not found on disk; not using them
2026-03-12 20:03:00,016 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 1 of 3. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:01,079 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 2 of 3. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:02,988 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 3 of 3. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:02,989 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 1 of 5. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:03,942 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 2 of 5. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:05,808 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 3 of 5. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:09,676 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 4 of 5. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:17,548 - google.auth.compute_engine._metadata - WARNING - Compute Engine Metadata server unavailable on attempt 5 of 5. Reason: http.client transport only supports the http scheme, httpswas specified
2026-03-12 20:03:17,549 - google.auth._default - WARNING - No project ID could be determined. Consider running `gcloud config set project` or setting the GOOGLE_CLOUD_PROJECT environment variable
--- Success! ---

It looks like this is coming up because _mtls.should_use_mds_mtls is returning True, but then _get_gce_credentials is using a non-SSL request. It seems this assumption has changed

A couple options are:

1. update http_client.Request to support SSL/mTLS
2. use a requests.Request in _get_gce_credentials. But this would have issues, because requests is an optional dependency, so we'd still need a backup method
3. update _mtls.should_use_mds_mtls to return False if requests isn't installed, to fall back to non-authenticated. (But we shouldn't fall back if STRICT mode is enabled)
4. Maybe make requests a required dependency?

The author of the feature is going to be back in office next week, so I will discuss it with him then

[daniel-sanche]

It looks like requests is already a required dependency for api_core, so maybe that is the right option

[m15pradeep]

I started facing this issue on Google Cloud Dataproc 2.2 (latest) when some of the libraries transitively started installing google-auth 2.49.1 (Dataproc ships with 2.41.1). I had to set GCE_METADATA_MTLS_MODE=none as a temporary fix.

[m15pradeep]

The suggested workaround of passing request=Request() to google.auth.default() doesn't help when the call is made internally by other Google Cloud libraries (e.g., Vertex AI, BigQuery). Users can't control how those libraries invoke google.auth.default(). The fix needs to be in google-auth itself, not in calling code. Setting GCE_METADATA_MTLS_MODE=none is the only workaround that works globally.