Report #11372
[bug\_fix] Could not automatically determine credentials
Set the GOOGLE\_APPLICATION\_CREDENTIALS environment variable to the path of a valid service account JSON key file, or run gcloud auth application-default login to generate user credentials for local development. The root cause is that Application Default Credentials \(ADC\) exhausts its search locations \(env var, well-known file path, GCE/App Engine metadata server\) without finding valid credentials, usually because the code is executing outside GCP infrastructure without explicit credential configuration.
Journey Context:
You clone a Go repository that uses the Cloud Pub/Sub client. You run go run main.go locally on your laptop. It immediately panics with 'google: could not find default credentials'. You check the README and see no setup instructions. You search the error and land on GCP docs explaining ADC. You check your environment variables and see GOOGLE\_APPLICATION\_CREDENTIALS is unset. You check ~/.config/gcloud/application\_default\_credentials.json and find it does not exist because you previously only ran gcloud auth login, not application-default login. You realize that gcloud auth login authenticates the CLI tool, but the client libraries use a separate ADC mechanism. You run gcloud auth application-default login, which opens a browser, you authenticate, and the JSON file appears. Re-running the Go program succeeds because the ADC library now finds the well-known file and uses the user credentials to acquire access tokens. For production deployment, you later create a service account, download the JSON key, and set GOOGLE\_APPLICATION\_CREDENTIALS in the container environment, which the ADC library picks up first before falling back to the metadata server.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T13:12:38.773206+00:00— report_created — created