GCP 'google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials' - how do I set up Application Default Credentials?

Cause: Google client libraries use Application Default Credentials (ADC). ADC looks in three places, in order: (1) the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a credential JSON file; (2) the local ADC file created by gcloud auth application-default login (on Linux/macOS $HOME/.config/gcloud/application_default_credentials.json, on Windows %APPDATA%\gcloud\application_default_credentials.json); (3) the service account attached to the resource via the metadata server (Compute Engine, Cloud Run, GKE and similar). If none exists, the library raises this error. Note that credentials from gcloud auth login are separate from ADC. Fix (best first): 1. Local development with your own account: install the gcloud CLI, then in a normal local shell (not Cloud Shell) run gcloud auth application-default login and sign in. Re-run your code. 2. Production on Google Cloud: attach a user-managed service account with minimal IAM roles to the resource (VM, Cloud Run service, GKE workload identity, and so on). No key file is needed. Google describes this as the preferred approach. 3. Local development acting as a service account: grant yourself the Service Account Token Creator role on it and run gcloud auth application-default login --impersonate-service-account SERVICE_ACCOUNT_EMAIL. Some libraries do not support impersonated local credentials. 4. Outside Google Cloud: prefer Workload Identity Federation or Workforce Identity Federation, and point GOOGLE_APPLICATION_CREDENTIALS at the generated configuration file. 5. Service account key file only as a last resort, since keys are a security risk if not managed correctly: export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json. Keep it out of source control and rotate or delete it when unused. 6. If the variable is set but wrong (for example pointing to a non-key file, or to a client ID file, which is not valid ADC), unset it or fix the path, because it overrides the other locations. Verify: gcloud auth application-default print-access-token prints a token (treat it as a secret), and your client library call authenticates without the error. For user credentials, if later calls complain about quota project or a disabled API, see the related fix for API enablement. Sources: https://docs.cloud.google.com/docs/authentication/application-default-credentials https://docs.cloud.google.com/docs/authentication/set-up-adc-local-dev-environment https://docs.cloud.google.com/docs/authentication/troubleshoot-adc