PyData Google Auth

Warnings

• breaking The default behavior of `get_user_credentials` for `use_local_webserver` changed from `False` to `True` in version 1.4.0. This was due to Google's deprecation of the "out of band" (copy-paste token) OAuth flow. If you were explicitly setting `use_local_webserver=False` and relying on the console-based flow, this might break your application if you update without adjustment.
  Fix: Ensure your environment allows for a local web server (ports 8080-8089 by default) for the OAuth callback, or explicitly set `use_local_webserver=False` and be prepared for the console-based flow, which may eventually cease to function. The `auth_local_webserver` parameter is also deprecated; use `use_local_webserver` instead.
• breaking Version 1.9.0 dropped support for Python versions older than 3.9. Projects on Python 3.8 or earlier will need to upgrade their Python interpreter to use this version or newer.
  Fix: Upgrade your Python environment to 3.9 or newer. Python 3.13 is now officially supported.
• gotcha When developing a tool or library, you should provide your own `client_id` and `client_secret` when calling `get_user_credentials` to prevent masking your API client's identity, as per Google APIs terms of service.
  Fix: Obtain your own OAuth 2.0 Client ID and secret from the Google Cloud Console and pass them to the `client_id` and `client_secret` parameters of `get_user_credentials`.
• gotcha For service account credentials, the JSON key file contains sensitive information. It is critical to manage this file securely, never commit it to source control, and use environment variables or secure storage mechanisms in production environments.
  Fix: Store the service account key in a secure location and reference its path via an environment variable (e.g., `GOOGLE_APPLICATION_CREDENTIALS`) or load it from a secure secret manager. Avoid hardcoding paths or embedding keys directly in code.
• gotcha By default, `pydata-google-auth` caches user credentials on disk in `$HOME/.config/pydata/pydata_google_credentials.json` (or `$APPDATA` on Windows). On shared computing resources like Google Colab or GCE VMs, writing credentials to disk may be undesirable or insecure.
  Fix: To prevent credentials from being written to disk, pass `credentials_cache=pydata_google_auth.cache.NOOP` to `get_user_credentials` or `default`.

Install

• pip install pydata-google-auth Install latest version

Imports

• get_user_credentials

  from pydata_google_auth import get_user_credentials

  Used for authenticating with user accounts via OAuth 2.0 flow.
• load_service_account_credentials

  from pydata_google_auth import load_service_account_credentials

  Used for authenticating with service accounts using a JSON key file.
• default

  from pydata_google_auth import default

  Attempts to get Application Default Credentials and falls back to user credentials if not found.

Quickstart

This quickstart demonstrates how to obtain user credentials using `get_user_credentials` and then use them to initialize a Google Cloud BigQuery client. The process will typically open a browser window for you to authenticate via Google's OAuth 2.0 flow if credentials are not already cached.

import os
from pydata_google_auth import get_user_credentials
from google.cloud import bigquery

# Define the necessary scopes for BigQuery access
SCOPES = [
    'https://www.googleapis.com/auth/cloud-platform',
    'https://www.googleapis.com/auth/bigquery'
]

# Get user credentials (will open a browser for OAuth flow if not cached)
# `use_local_webserver=True` is the default and recommended for desktop apps.
credentials = get_user_credentials(SCOPES)

# Use an environment variable for project_id or replace with your actual ID
project_id = os.environ.get('GCP_PROJECT_ID', 'your-gcp-project-id')

# Initialize a Google Cloud BigQuery client with the obtained credentials
client = bigquery.Client(project=project_id, credentials=credentials)

print(f"Authenticated successfully to project: {client.project}.")
print("You can now use 'client' to interact with BigQuery.")

# Example: List datasets (requires appropriate permissions for the scopes)
try:
    datasets = list(client.list_datasets())
    if datasets:
        print(f"Found {len(datasets)} datasets.")
    else:
        print("No datasets found in the project.")
except Exception as e:
    print(f"Error listing datasets: {e}")