Google Auth

Common errors

Warnings

Install

Install compatibility verified last tested: 2026-05-12

Imports

• google.auth.default
  wrong

  from oauth2client.client import GoogleCredentials
  credentials = GoogleCredentials.get_application_default()

  correct

  import google.auth
  credentials, project = google.auth.default()

  oauth2client is deprecated; google-auth is its replacement. Never use oauth2client in new code.

• service_account.Credentials

  from google.oauth2 import service_account
  creds = service_account.Credentials.from_service_account_file('key.json')

  Service account credentials for server-to-server calls; must call .with_scopes() separately if scopes were not passed at construction time.

• google.auth.transport.requests.Request

  from google.auth.transport.requests import Request

  Used to build an HTTP Request object for refreshing credentials; requires the requests extra.

• google.oauth2.credentials.Credentials

  from google.oauth2.credentials import Credentials

  Holds OAuth 2.0 user credentials; typically produced by google-auth-oauthlib InstalledAppFlow, not constructed directly.

• google.auth.impersonated_credentials.Credentials

  from google.auth import impersonated_credentials

  Used to impersonate a service account; source credentials must have the Service Account Token Creator IAM role.

• google.auth.exceptions.DefaultCredentialsError

  from google.auth.exceptions import DefaultCredentialsError

  Raised by google.auth.default() when no credentials are found in the environment; always catch this, not a bare Exception.

Quickstart stale last tested: 2026-04-23

Demonstrates Application Default Credentials (ADC) via google.auth.default() and explicit service account credentials. Set GOOGLE_APPLICATION_CREDENTIALS to a service account JSON key path, or authenticate locally with `gcloud auth application-default login`.

import os
import google.auth
from google.auth.transport.requests import Request
from google.oauth2 import service_account
from google.auth.exceptions import DefaultCredentialsError

# --- Option 1: Application Default Credentials (recommended for GCP-hosted workloads)
# Set GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json, or run:
#   gcloud auth application-default login
os.environ.setdefault('GOOGLE_APPLICATION_CREDENTIALS', os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', ''))

try:
    credentials, project = google.auth.default(
        scopes=['https://www.googleapis.com/auth/cloud-platform']
    )
    # Force a token refresh so we can verify auth works
    credentials.refresh(Request())
    print(f'ADC OK — project={project}, token expiry={credentials.expiry}')
except DefaultCredentialsError as e:
    print(f'No credentials found: {e}')

# --- Option 2: Explicit service account key file
key_path = os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', '')
if key_path:
    sa_creds = service_account.Credentials.from_service_account_file(
        key_path,
        scopes=['https://www.googleapis.com/auth/cloud-platform'],
    )
    sa_creds.refresh(Request())
    print(f'SA token expiry: {sa_creds.expiry}')