diff --git a/lib/ensureDefaultCredentials.js b/lib/ensureDefaultCredentials.js
index 2a4a42bfd8b..f0b2bb2bea4 100644
--- a/lib/ensureDefaultCredentials.js
+++ b/lib/ensureDefaultCredentials.js
@@ -31,11 +31,13 @@ module.exports = function() {
     "application_default_credentials.json"
   );
 
+  var tokens = configstore.get("tokens") || {};
+
   var credentials = {
     client_id: api.clientId,
     client_secret: api.clientSecret,
     type: "authorized_user",
-    refresh_token: configstore.get("tokens").refresh_token,
+    refresh_token: tokens.refresh_token || process.env.FIREBASE_TOKEN,
   };
   // Mimic the effects of running "gcloud auth application-default login"
   fs.ensureDirSync(GCLOUD_CREDENTIAL_DIR);