Overview¶

For a language agnostic overview of authentication on Google Cloud, seeAuthentication Overview.

• If you’re running in a Google Virtual Machine Environment (Compute Engine, App Engine, Cloud Run, Cloud Functions),authentication should “just work”.

• If you’re developing locally,the easiest way to authenticate is using theGoogle Cloud SDK:

  $gcloudauthapplication-defaultlogin

  Note that this command generates credentials for client libraries. To authenticate the CLI itself, use:

  $gcloudauthlogin

  Previously,gcloudauthlogin was used for both use cases. Ifyourgcloud installation does not support the new command,please update it:

  $gcloudcomponentsupdate

• If you’re running your application elsewhere,you should download aservice account JSON keyfileand point to it using an environment variable:

  $exportGOOGLE_APPLICATION_CREDENTIALS="/path/to/keyfile.json"

Client-Provided Authentication¶

Every package uses aClientas a base for interacting with an API.For example:

fromgoogle.cloudimportdatastoreclient=datastore.Client()

Passing no arguments at all will “just work” if you’ve followed theinstructions in theOverview.The credentials are inferred from your local environment by usingGoogleApplication Default Credentials.

Explicit Credentials¶

The Application Default Credentials discussed above can be usefulif your code needs to run in many different environments orif you just don’t want authentication to be a focus in your code.

However, you may want to be explicit because

• your code will only run in one place

• you may have code which needs to be run as a specific service accountevery time (rather than with the locally inferred credentials)

• you may want to use two separate accounts to simultaneously access datafrom different projects

In these situations, you can create an explicitCredentials object suited to your environment.After creation, you can pass it directly to aClient:

client=Client(credentials=credentials)

fromgoogle.authimportcompute_enginecredentials=compute_engine.Credentials()

fromgoogle.oauth2importservice_accountcredentials=service_account.Credentials.from_service_account_file('/path/to/key.json')

importjsonfromgoogle.oauth2importservice_accountjson_account_info=json.loads(...)# convert JSON to dictionarycredentials=service_account.Credentials.from_service_account_info(json_account_info)

importgoogle.authcredentials,project=google.auth.default()

Troubleshooting¶