google.auth package¶

Google Auth Library for Python.

default(scopes=None,request=None,quota_project_id=None,default_scopes=None)[source]¶

Gets the default credentials for the current environment.

Application Default Credentials provides an easy way to obtaincredentials to call Google APIs for server-to-server or local applications.This function acquires credentials from the environment in the followingorder:

1. If the environment variableGOOGLE_APPLICATION_CREDENTIALS is setto the path of a valid service account JSON private key file, then it isloaded and returned. The project ID returned is the project ID definedin the service account file if available (some older files do notcontain project ID information).

   If the environment variable is set to the path of a valid externalaccount JSON configuration file (workload identity federation), then theconfiguration file is used to determine and retrieve the externalcredentials from the current environment (AWS, Azure, etc).These will then be exchanged for Google access tokens via the Google STSendpoint.The project ID returned in this case is the one corresponding to theunderlying workload identity pool resource if determinable.

   If the environment variable is set to the path of a valid GDCH serviceaccount JSON file (Google Distributed Cloud Hosted), then a GDCHcredential will be returned. The project ID returned is the projectspecified in the JSON file.

2. If theGoogle Cloud SDK is installed and has application defaultcredentials set they are loaded and returned.

   To enable application default credentials with the Cloud SDK run:

   gcloudauthapplication-defaultlogin

   If the Cloud SDK has an active project, the project ID is returned. Theactive project can be set using:

   gcloudconfigsetproject

3. If the application is running in theApp Engine standard environment(first generation) then the credentials and project ID from theApp Identity Service are used.

4. If the application is running inCompute Engine orCloud Run ortheApp Engine flexible environment or theApp Engine standardenvironment (second generation) then the credentials and project IDare obtained from theMetadata Service.

5. If no credentials are found,DefaultCredentialsError will be raised.

Example:

importgoogle.authcredentials,project_id=google.auth.default()

Parameters:

• scopes (Sequencestr) – The list of scopes for the credentials. Ifspecified, the credentials will automatically be scoped ifnecessary.

• request (Optionalgoogle.auth.transport.Request) – An object used to makeHTTP requests. This is used to either detect whether the applicationis running on Compute Engine or to determine the associated projectID for a workload identity pool resource (external accountcredentials). If not specified, then it will either use the standardlibrary http client to make requests for Compute Engine credentialsor a google.auth.transport.requests.Request client for externalaccount credentials.

• quota_project_id (Optionalstr) – The project ID used forquota and billing.

• default_scopes (OptionalSequencestr) – Default scopes passed by aGoogle client library. Use ‘scopes’ for user-defined scopes.

Returns:

the current environment’s credentials and project ID. Project IDmay be None, which indicates that the Project ID could not beascertained from the environment.

Return type:

TupleCredentials,Optionalstr

Raises:

DefaultCredentialsError – If no credentials were found, or if the credentials found were invalid.

load_credentials_from_file(filename,scopes=None,default_scopes=None,quota_project_id=None,request=None)[source]¶

Loads Google credentials from a file.

The credentials file must be a service account key, stored authorizeduser credentials, external account credentials, or impersonated serviceaccount credentials.

Warning

Important: If you accept a credential configuration (credential JSON/File/Stream)from an external source for authentication to Google Cloud Platform, you mustvalidate it before providing it to any Google API or client library. Providing anunvalidated credential configuration to Google APIs or libraries can compromisethe security of your systems and data. For more information, refer toValidate credential configurations from external sources.

Parameters:

• filename (str) – The full path to the credentials file.

• scopes (OptionalSequencestr) – The list of scopes for the credentials. Ifspecified, the credentials will automatically be scoped ifnecessary

• default_scopes (OptionalSequencestr) – Default scopes passed by aGoogle client library. Use ‘scopes’ for user-defined scopes.

• quota_project_id (Optionalstr) – The project ID used forquota and billing.

• request (Optionalgoogle.auth.transport.Request) – An object used to makeHTTP requests. This is used to determine the associated project IDfor a workload identity pool resource (external account credentials).If not specified, then it will use agoogle.auth.transport.requests.Request client to make requests.

Returns:

Loaded

credentials and the project ID. Authorized user credentials do nothave the project ID information. External account credentials projectIDs may not always be determined.

Return type:

Tuplegoogle.auth.credentials.Credentials,Optionalstr

Raises:

google.auth.exceptions.DefaultCredentialsError – if the file is in the wrong format or is missing.

load_credentials_from_dict(info,scopes=None,default_scopes=None,quota_project_id=None,request=None)[source]¶

Loads Google credentials from a dict.

The credentials file must be a service account key, stored authorizeduser credentials, external account credentials, or impersonated serviceaccount credentials.

Warning

Important: If you accept a credential configuration (credential JSON/File/Stream)from an external source for authentication to Google Cloud Platform, you mustvalidate it before providing it to any Google API or client library. Providing anunvalidated credential configuration to Google APIs or libraries can compromisethe security of your systems and data. For more information, refer toValidate credential configurations from external sources.

Parameters:

• info (Dictstr,Any) – A dict object containing the credentials

• scopes (OptionalSequencestr) – The list of scopes for the credentials. Ifspecified, the credentials will automatically be scoped ifnecessary

• default_scopes (OptionalSequencestr) – Default scopes passed by aGoogle client library. Use ‘scopes’ for user-defined scopes.

• quota_project_id (Optionalstr) – The project ID used forquota and billing.

• request (Optionalgoogle.auth.transport.Request) – An object used to makeHTTP requests. This is used to determine the associated project IDfor a workload identity pool resource (external account credentials).If not specified, then it will use agoogle.auth.transport.requests.Request client to make requests.

Returns:

Loaded

credentials and the project ID. Authorized user credentials do nothave the project ID information. External account credentials projectIDs may not always be determined.

Return type:

Tuplegoogle.auth.credentials.Credentials,Optionalstr

Raises:

google.auth.exceptions.DefaultCredentialsError – if the file is in the wrong format or is missing.