google-cloud-recipe-auth

Run gcloud auth application-default login to create local Application Default Credentials. Google Cloud client libraries like the Python storage client automatically find these credentials, so your code acts as your user identity without downloading service account keys.

gcloud auth login authenticates the gcloud CLI itself for management commands. gcloud auth application-default login creates a local credential file that client libraries use via Application Default Credentials when your code calls Google Cloud APIs.

No. Attach a custom least-privilege service account directly to the resource, such as a Compute Engine VM or Cloud Run service, so the environment provides short-lived tokens via the metadata server. For external clouds, use Workload Identity Federation instead.

Use Workload Identity Federation to exchange an external token, such as an AWS IAM role credential, for a short-lived Google Cloud access token. This avoids storing static service account keys outside Google Cloud.

Legacy Compute Engine VMs and GKE node pools also enforce OAuth access scopes alongside IAM. If the VM's scope is restricted, API calls fail even with correct IAM permissions, so check the access scopes first.

The calling service generates a Google-signed OpenID Connect ID token and sends it in the Authorization Bearer header. The private Cloud Run service verifies this OIDC token before allowing the request.