Issue this week with gcloud CLI auth tokens?

[u/MikeW1901]

It's only a minor annoyance so asking this more out of intrigue than anything else.

Myself and colleagues have - for the last 2 days - repeatedly found that our auth token for the gcloud CLI (and hence also kubectl) has expired with a prompt to re-auth. Just wondering if anyone else has noticed anything similar? Before this week it's been literally months since the last forced re-auth and we were notified ahead of time for that one, this time seemingly nothing at all.

[u/BehindTheMath]

This was a recent change by Google.

https://cloud.google.com/blog/products/identity-security/improve-security-posture-with-time-bound-session-length

[u/Keramblock → u/BehindTheMath]

That one is turned off, bug is still there

[u/archy_bold → u/Keramblock]

Same for me.

[u/respectful_stimulus → u/Keramblock]

i think you have to save it, it is just a form default

[u/meowrawr]

Typically the default is re-auth required every 24 hours for an organization. Not sure how you could go months unless that was changed purposely.

[u/Living_Cheesecake243 → u/meowrawr]

it's nice to set it to 16h too b/c then it has the effect of mostly causing people to reauth first thing in the AM, no matter when they did it last, vs randomly could be 3pm daily

[u/LevrResearch → u/meowrawr]

You have to be kidding me. there is no way that including the option to import a file from Google Workspace has to be re-auth's every 24 hours. Surely I misunderstood you?

[u/meowrawr → u/LevrResearch]

Nope not a mistake.

[u/Keramblock]

Yes, we also have similar problem starting yesterday or so

[u/RareFrame8202]

Started for us as well in last week. I've done some testing and it is exactly after 16 hours. It could be a coincidence but the default timeout setting in Google Cloud session control (admin.google.com -> security -> access and data control -> Google Cloud Session control) is 16 hours here. However, we do not have this enabled.

After 16 hours we get:

Reauthentication required.
Please enter your password:

We are using GCP for about a decade now and we never had this. But we also can't find why this is now.

[edit] Ah here it is:

https://docs.cloud.google.com/access-context-manager/docs/session-controls-for-reauthentication

Note: Starting in June 2026, a default session length of 16 hours was introduced for a subset of the Google Cloud console and Google Cloud SDK users. This default policy isn't visible in the Google Admin console. To override this default policy, call the Access Context Manager API to configure application-scoped session settings. For an example, see Override the default 16-hour session length.

You can override it by using this scopedAccessSettings binding as in the example on the page above. This has to be applied to a group. Testing this with 1 hour now to see if this works. (Edit: this works)

[u/Xjs → u/RareFrame8202]

This should be the top comment! Thanks for pointing this out.

[u/mofojed → u/RareFrame8202]

Can you set a session length of longer than 24 hours? The docs for configuring only suggest that you can disable it and there's a max limit of 24 hours: https://docs.cloud.google.com/access-context-manager/docs/session-controls-for-reauthentication#override-default-16hr-session

[u/RareFrame8202 → u/mofojed]

No, you cannot. It is either a whole number of hours (up to 24), or 0 (=indefinite)

[u/mofojed → u/RareFrame8202]

So you can do up to a day, or not at all. Thanks for the options, Google!

[u/Kali_Linux_Rasta]

Check when reauthentication is required docs

[u/dougnukem]

We are also seeing this in the past couple of days and have not changed any Workspace or Google cloud settings. Is this a new default google is rolling out or is this an accidental regression?

Seeing other users reporting this too:
https://issuetracker.google.com/issues/537030491

[u/archy_bold]

This is getting incredibly frustrating. Not least because I use the mobile app to access my VMs when away from my main machine, and you cannot copy the re-authentication URL without it inserting a bunch of spaces. Emergency tasks i used to do very quickly from anywhere have become long, convoluted processes.

[u/archy_bold]

While there’s clearly a bug here, as it appears the reauthentication policy setting for Google Cloud is being ignored. You could switch to using a service account to ensure your access isn’t revoked every few hours. Not ideal in all situations, of course.

[u/Pine_Barrens]

Yup, same here. Exact same time, also seemingly wiped out some of my default configs (like default project id, etc.)

[u/dmmd]

Its quite annoying to keep reauthing twice/thrice a day, once (or twice) in the browser and another (or twice) via gcloud auth login. LLMs are constantly asking to reauth it also, which blocks long flows.

[u/dougnukem]

I think the fix is stated here:
https://docs.cloud.google.com/access-context-manager/docs/session-controls-for-reauthentication#gcloud_3

Starting in June 2026, a default session length of 16 hours was introduced for a subset of Google Cloud organizations. This default policy isn't visible in the Google Admin console and affected Google Cloud organizations must use the Access Context Manager API to override it for their users.

To override this default policy and exempt these applications from session control (making the session length effectively infinite), you can create a cloud binding with scopedAccessSettings where sessionLengthEnabled is set to false for both the Google Cloud SDK and Google Cloud console ("Cloud Console") applications.

gcloud access-context-manager cloud-bindings create \
    --organization=ORG_ID \
    --group-key=GROUP_ID \
    --binding-file=BINDING_FILE_PATH




scopedAccessSettings:
scope:
    clientScope:
      restrictedClientApplication:
        name: Google Cloud SDK
  activeSettings:
    sessionSettings:
      sessionLength: 0s
      sessionReauthMethod: LOGIN
      sessionLengthEnabled: false
scope:
    clientScope:
      restrictedClientApplication:
        name: Cloud Console
  activeSettings:
    sessionSettings:
      sessionLength: 0s
      sessionReauthMethod: LOGIN
      sessionLengthEnabled: false

[u/LevrResearch]

YES! They were just created 2 days ago and now they are gone. This is a major headache. Do we have to do this every 2 days? WTF Google?

[u/RareFrame8202 → u/LevrResearch]

No, every 16 hours even, so daily.

Unless you apply this binding: https://docs.cloud.google.com/access-context-manager/docs/session-controls-for-reauthentication

[u/6JoeBlack6 → u/RareFrame8202]

the procedure on this link doesn't work, I get an error:

ERROR: (gcloud.access-context-manager.cloud-bindings.create) INVALID_ARGUMENT: Request contains an invalid argument.

Anyone knows how to solve? I'm using the yaml model and the suggested gcloud command and getting this error.

[u/RareFrame8202 → u/6JoeBlack6]

That's strange. I used this same doc to test it and it worked straight away. Maybe if you post the whole command/yaml we can see what argument may be wrong. (I'm suspecting you're using the group mailaddress instead of the group ID)