{"id":273,"library":"google-auth","title":"Google Auth","description":"google-auth is the official Google Authentication Library for Python, providing Application Default Credentials (ADC), service account credentials, OAuth2 tokens, JWT signing/verification, ID token support, Workload Identity Federation, and transport integrations for Requests, urllib3, aiohttp, and gRPC. Current stable version is 2.49.1, released as part of the google-cloud-python monorepo with a roughly monthly cadence.","status":"active","version":"2.49.1","language":"python","source_language":"en","source_url":"https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth","tags":["google","authentication","oauth2","credentials","adc","service-account","jwt","gcp","workload-identity"],"install":[{"cmd":"pip install google-auth","lang":"bash","label":"Core (no transport)"},{"cmd":"pip install google-auth[requests]","lang":"bash","label":"With requests transport"},{"cmd":"pip install google-auth[aiohttp]","lang":"bash","label":"With async aiohttp transport"}],"dependencies":[{"reason":"Required since 2.48.0 for RSA signing/verification; previously optional, now a hard dependency replacing the deprecated pure-Python rsa package","package":"cryptography","optional":false},{"reason":"Required for google.auth.transport.requests.Request and AuthorizedSession; install via google-auth[requests]","package":"requests","optional":true},{"reason":"Required for google.auth.transport.aiohttp_requests async transport; install via google-auth[aiohttp]","package":"aiohttp","optional":true},{"reason":"Needed for mutual TLS (mTLS) via the pyopenssl extra; must NOT be combined with enterprise-cert extra","package":"pyOpenSSL","optional":true}],"imports":[{"note":"oauth2client is deprecated; google-auth is its replacement. Never use oauth2client in new code.","wrong":"from oauth2client.client import GoogleCredentials\ncredentials = GoogleCredentials.get_application_default()","symbol":"google.auth.default","correct":"import google.auth\ncredentials, project = google.auth.default()"},{"note":"Service account credentials for server-to-server calls; must call .with_scopes() separately if scopes were not passed at construction time.","symbol":"service_account.Credentials","correct":"from google.oauth2 import service_account\ncreds = service_account.Credentials.from_service_account_file('key.json')"},{"note":"Used to build an HTTP Request object for refreshing credentials; requires the requests extra.","symbol":"google.auth.transport.requests.Request","correct":"from google.auth.transport.requests import Request"},{"note":"Holds OAuth 2.0 user credentials; typically produced by google-auth-oauthlib InstalledAppFlow, not constructed directly.","symbol":"google.oauth2.credentials.Credentials","correct":"from google.oauth2.credentials import Credentials"},{"note":"Used to impersonate a service account; source credentials must have the Service Account Token Creator IAM role.","symbol":"google.auth.impersonated_credentials.Credentials","correct":"from google.auth import impersonated_credentials"},{"note":"Raised by google.auth.default() when no credentials are found in the environment; always catch this, not a bare Exception.","symbol":"google.auth.exceptions.DefaultCredentialsError","correct":"from google.auth.exceptions import DefaultCredentialsError"}],"quickstart":{"code":"import os\nimport google.auth\nfrom google.auth.transport.requests import Request\nfrom google.oauth2 import service_account\nfrom google.auth.exceptions import DefaultCredentialsError\n\n# --- Option 1: Application Default Credentials (recommended for GCP-hosted workloads)\n# Set GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json, or run:\n#   gcloud auth application-default login\nos.environ.setdefault('GOOGLE_APPLICATION_CREDENTIALS', os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', ''))\n\ntry:\n    credentials, project = google.auth.default(\n        scopes=['https://www.googleapis.com/auth/cloud-platform']\n    )\n    # Force a token refresh so we can verify auth works\n    credentials.refresh(Request())\n    print(f'ADC OK — project={project}, token expiry={credentials.expiry}')\nexcept DefaultCredentialsError as e:\n    print(f'No credentials found: {e}')\n\n# --- Option 2: Explicit service account key file\nkey_path = os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', '')\nif key_path:\n    sa_creds = service_account.Credentials.from_service_account_file(\n        key_path,\n        scopes=['https://www.googleapis.com/auth/cloud-platform'],\n    )\n    sa_creds.refresh(Request())\n    print(f'SA token expiry: {sa_creds.expiry}')\n","lang":"python","description":"Demonstrates Application Default Credentials (ADC) via google.auth.default() and explicit service account credentials. Set GOOGLE_APPLICATION_CREDENTIALS to a service account JSON key path, or authenticate locally with `gcloud auth application-default login`."},"warnings":[{"fix":"Ensure cryptography is installed (it is now pulled in automatically). Remove any explicit rsa dependency pins. Do not install the legacy [rsa] extra expecting it to substitute for cryptography.","message":"cryptography is now a required (non-optional) dependency as of 2.48.0. The pure-Python rsa package was the previous fallback and has been fully removed in the 2.49.0-dev0 line. Environments that pin rsa or exclude cryptography will break on upgrade.","severity":"breaking","affected_versions":">=2.48.0"},{"fix":"Remove direct cachetools imports from google-auth credential caching logic. The library now uses its own lightweight internal cache.","message":"cachetools is no longer a dependency as of 2.47.0. Code that imported or type-annotated against cachetools classes for credential caching will break.","severity":"breaking","affected_versions":">=2.47.0"},{"fix":"Choose one: pip install google-auth[pyopenssl] OR pip install google-auth[enterprise-cert], never both in the same environment.","message":"The pyopenssl and enterprise_cert extras must never be installed together; they require conflicting versions of the cryptography package and will cause runtime errors.","severity":"breaking","affected_versions":">=2.x"},{"fix":"Always check: assert project is not None, or override with GOOGLE_CLOUD_PROJECT env var, or pass project explicitly to the client.","message":"google.auth.default() returns a (credentials, project_id) tuple. project_id is None for user credentials (gcloud ADC) and may be None for some external account credentials. Silently passing None as a project to GCP client constructors causes subtle 400/403 errors.","severity":"gotcha","affected_versions":"all"},{"fix":"Always pass scopes=['https://www.googleapis.com/auth/cloud-platform'] (or specific scopes) to google.auth.default(). Alternatively call credentials.with_scopes([...]) on the returned object.","message":"Service account credentials returned by google.auth.default() via ADC are not automatically scoped. Calling google.auth.default() without passing scopes= yields credentials that may silently fail when making API calls requiring specific OAuth scopes.","severity":"gotcha","affected_versions":"all"},{"fix":"Migrate to google-auth: replace oauth2client imports with google.auth.default() or google.oauth2.service_account.Credentials.","message":"oauth2client (GoogleCredentials.get_application_default()) is fully deprecated and unmaintained. It is not compatible with modern ADC features such as Workload Identity Federation and external account credentials.","severity":"deprecated","affected_versions":"all oauth2client versions"},{"fix":"Upgrade to Python 3.10+. If stuck on Python 3.7, pin google-auth<=2.45.0.","message":"Python 3.7 support was dropped after 2.45.0, and Python 3.8/3.9 are end-of-life and will be dropped in a future release. Pinning google-auth on old Python runtimes may leave you unable to receive security fixes.","severity":"gotcha","affected_versions":"<2.46.0 for Py3.7; upcoming for Py3.8/3.9"},{"fix":"Ensure ADC are configured: set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or ensure the application runs on a Google Cloud service with an attached service account.","message":"Application Default Credentials (ADC) were not found. This typically means the environment variable GOOGLE_APPLICATION_CREDENTIALS is not set, `gcloud auth application-default login` has not been run, or the application is not running on a Google Cloud service with an attached service account.","severity":"gotcha","affected_versions":"all"},{"fix":"Ensure ADC is configured correctly. Set GOOGLE_APPLICATION_CREDENTIALS to a service account key file, or run gcloud auth application-default login, or ensure the environment (e.g., GCE, Cloud Run, Cloud Functions) has an appropriate service account attached.","message":"The library could not find Application Default Credentials (ADC). This means the environment is not configured to provide credentials automatically (e.g., GOOGLE_APPLICATION_CREDENTIALS env var is missing, gcloud auth application-default login has not been run, or it's not running on a Google Cloud platform with a service account attached).","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"last_verified":"2026-05-12T12:42:32.922Z","next_check":"2026-06-26T00:00:00.000Z","problems":[{"fix":"Ensure the necessary packages are installed using pip: `pip install google-auth google-auth-oauthlib google-api-python-client`.","cause":"The `google-auth` library or one of its dependent packages (e.g., `google-auth-oauthlib`, `google-api-python-client`) is not installed, or the Python environment where the code is being run does not have access to the installed library.","error":"ModuleNotFoundError: No module named 'google.auth'"},{"fix":"Set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of your service account key JSON file, or run `gcloud auth application-default login` to set up user credentials for local development.","cause":"The Application Default Credentials (ADC) mechanism failed to find valid credentials. This typically happens when running outside a Google Cloud environment (like Compute Engine, App Engine) without explicitly providing credentials.","error":"google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials."},{"fix":"Change your OAuth consent screen's publishing status to 'In production' in the Google Cloud Console. If for personal or development use, re-authenticate to obtain a new, long-lived refresh token and ensure the client ID, secret, and requested scopes are correct.","cause":"This error, often accompanied by 'invalid_grant', means the refresh token used to get a new access token is invalid, expired, or revoked. A common cause is an OAuth consent screen configured with a 'Testing' publishing status, which causes refresh tokens to expire after 7 days.","error":"google.auth.exceptions.RefreshError: ('unauthorized_client: Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested."},{"fix":"Correct the import statement to `from google.auth.transport import requests` to access the HTTP client within the transport layer.","cause":"The `requests` module within the `google.auth.transport` package is being imported incorrectly. `google.auth.transport` is a package, not a module containing the `requests` HTTP client directly.","error":"AttributeError: module 'google.auth.transport' has no attribute 'requests'"}],"ecosystem":"pypi","meta_description":null,"install_score":100,"install_tag":"verified","quickstart_score":0,"quickstart_tag":"stale","pypi_latest":null,"install_checks":{"last_tested":"2026-05-12","tag":"verified","tag_description":"installs cleanly on critical runtimes, fast import, recently tested","results":[{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":1.5,"disk_size":"37.9M"},{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":1.5,"disk_size":"49.8M"},{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":1.5,"disk_size":"41.2M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":1.5,"disk_size":"38M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":1.5,"disk_size":"52M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":1.5,"disk_size":"42M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.11,"mem_mb":1.7,"disk_size":"40.8M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.1,"mem_mb":1.7,"disk_size":"54.2M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.11,"mem_mb":1.7,"disk_size":"44.4M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.09,"mem_mb":1.7,"disk_size":"41M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.09,"mem_mb":1.7,"disk_size":"57M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.09,"mem_mb":1.7,"disk_size":"45M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.09,"mem_mb":1.5,"disk_size":"32.5M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.09,"mem_mb":1.5,"disk_size":"45.8M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.09,"mem_mb":1.5,"disk_size":"36.0M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.08,"mem_mb":1.5,"disk_size":"33M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.09,"mem_mb":1.5,"disk_size":"48M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.08,"mem_mb":1.5,"disk_size":"36M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":1.8,"disk_size":"32.1M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":1.8,"disk_size":"45.0M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.08,"mem_mb":1.8,"disk_size":"35.7M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.08,"mem_mb":1.6,"disk_size":"33M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.07,"mem_mb":1.6,"disk_size":"47M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.08,"mem_mb":1.6,"disk_size":"36M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":1.4,"disk_size":"38.1M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":1.4,"disk_size":"50.4M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.06,"mem_mb":1.4,"disk_size":"41.3M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.05,"mem_mb":1.4,"disk_size":"39M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"aiohttp","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.05,"mem_mb":1.4,"disk_size":"53M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"requests","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.05,"mem_mb":1.4,"disk_size":"42M"}]},"quickstart_checks":{"last_tested":"2026-04-23","tag":"stale","tag_description":"widespread failures or data too old to trust","results":[{"runtime":"python:3.10-alpine","exit_code":1},{"runtime":"python:3.10-slim","exit_code":1},{"runtime":"python:3.11-alpine","exit_code":1},{"runtime":"python:3.11-slim","exit_code":1},{"runtime":"python:3.12-alpine","exit_code":1},{"runtime":"python:3.12-slim","exit_code":1},{"runtime":"python:3.13-alpine","exit_code":1},{"runtime":"python:3.13-slim","exit_code":1},{"runtime":"python:3.9-alpine","exit_code":1},{"runtime":"python:3.9-slim","exit_code":1}]}}