确认发出请求的主账号具有所需的 IAM 角色。如果您使用的是用户凭据，则必须向与用户账号关联的电子邮件地址授予这些角色。如果您使用的是服务账号，该服务账号必须具有所需的角色。
如果您在 API 请求中提供 API 密钥，则 API 密钥在任何位置都优先于 ADC。如果您已设置 GOOGLE_APPLICATION_CREDENTIALS 环境变量并且使用的是 API 密钥，则 API 可能会返回一条警告，告知您提供给 ADC 的凭据将予以忽略。如需停止警告，请取消设置 GOOGLE_APPLICATION_CREDENTIALS 环境变量。
凭据类型无法识别
如果您的 API 请求返回包含 Error creating credential
from JSON. Unrecognized credential type 的错误，请确保您使用的是有效的凭据。系统不支持使用客户端 ID 文件为 ADC 提供凭据。
服务账号模拟返回的本地凭据错误
并非所有身份验证库都支持使用服务账号模拟生成的本地 ADC 文件中的凭据。如果您的调用返回类似于 Neither metadata server or valid service
account credentials are found 的错误，则无法使用本地模拟凭据执行此任务。
如果您尝试创建本地 ADC 文件，但系统返回类似于 This app
is blocked 或 Access blocked: Authorization Error 的错误，则表示您可能尝试使用默认 ADC 设置命令不支持的范围。通常，此问题是由于添加了 Google Cloud之外的应用程序范围（例如 Google 云端硬盘）引起的。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis page covers common issues encountered when using Application Default Credentials (ADC), including problems with user credentials, incorrect credentials, unrecognized credential types, errors with service account impersonation, quota project issues, and access blocked by scopes.\u003c/p\u003e\n"],["\u003cp\u003eWhen using client-based APIs with user credentials, a quota project must be specified for billing and quota purposes; this can be set through the ADC file, the gcloud CLI config, or the \u003ccode\u003ex-goog-user-project\u003c/code\u003e HTTP header.\u003c/p\u003e\n"],["\u003cp\u003eIf user credentials are not working, ensure that the API is enabled in the specified project, and that the user has the \u003ccode\u003eserviceusage.services.use\u003c/code\u003e IAM permission or the Service Usage Consumer role.\u003c/p\u003e\n"],["\u003cp\u003eWhen troubleshooting credential access problems, confirm that the correct credentials are being used, the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable is set appropriately, the requesting principal has the required IAM roles, and that an API key isn't overriding ADC.\u003c/p\u003e\n"],["\u003cp\u003eIf you receive an "Access blocked" error when creating a local ADC file, check if you're using scopes unsupported by the default ADC setup, and if necessary, use an OAuth Client ID to add scopes for non-Google Cloud services.\u003c/p\u003e\n"]]],[],null,["This page describes some common problems you might encounter when using\nApplication Default Credentials (ADC).\n\nFor information about how ADC works, including where credentials are found, see\n[How Application Default Credentials works](/docs/authentication/application-default-credentials).\n\nUser credentials not working\n\nIf your API request returns an error message about user credentials not being\nsupported by this API, the API not being enabled in the project, or no quota\nproject being set, review the following information.\n\nThere are two kinds of Google Cloud APIs:\n\n- *Resource-based APIs*, which use the project associated with the resources\n being accessed for billing and quota.\n\n- *Client-based APIs*, which use the project associated with the client\n accessing the resources for billing and quota.\n\nWhen you provide user credentials to authenticate to a client-based API, you\nmust specify the project to use for billing and quota. This project is called\nthe *quota project*.\n\nThere are a number of ways to specify a quota project, including the following\noptions:\n\n- Update your ADC file to use a different project as the quota project:\n\n ```\n gcloud auth application-default set-quota-project YOUR_PROJECT\n ```\n- If you are using the gcloud CLI to call the API, you can set\n your quota project in your gcloud CLI config:\n\n ```\n gcloud config set billing/quota_project YOUR_PROJECT\n ```\n- If you are calling the REST or RPC API directly, use the\n `x-goog-user-project` HTTP header to specify a quota project in each\n request. For details, see\n [Set the quota project with a REST request](/docs/authentication/rest#set-billing-project).\n\n| **Note:** The API you are trying to use must be enabled in whatever project you specify.\n\n\nYou must have the `serviceusage.services.use` IAM permission for\na project to be able to designate it as your billing project. The\n`serviceusage.services.use` permission is included in the Service Usage Consumer\nIAM role. If you don't have the `serviceusage.services.use`\npermission for any project, contact your security administrator or a project\nowner who can give you the Service Usage Consumer role in the project.\n\nFor more information about quota projects, see\n[Quota project overview](/docs/quotas/quota-project). For information about additional ways\nto set the quota project, see [Set the quota project](/docs/quotas/set-quota-project).\n\nIncorrect credentials\n\nIf your credentials don't seem to be providing the access you expect, or aren't\nfound, check the following:\n\n- If you are using the gcloud CLI to access Google Cloud in a\n local environment, make sure you understand which credentials you are using.\n When you use the gcloud CLI, you are using the credentials you\n provided to the gcloud CLI by using the `gcloud auth login`\n command. You are not using the credentials you provided to ADC. For more\n information about these two sets of credentials, see\n [gcloud CLI authentication configuration and ADC configuration](/docs/authentication/gcloud#gcloud-credentials).\n\n- Make sure that the `GOOGLE_APPLICATION_CREDENTIALS` environment variable is\n set *only* if you are using a service account key or other JSON file for ADC.\n The credentials pointed to by the environment variable take precedence over\n other credentials, including for Workload Identity Federation for GKE.\n\n- Confirm that the principal making the request has the required\n IAM roles. If you are using user credentials, then the roles\n must be granted to the email address associated with the user account. If\n you are using a service account, then that service account must have the\n required roles.\n\n- If you provide an API key with the API request, the API key takes precedence\n over ADC in any location. If you have set the `GOOGLE_APPLICATION_CREDENTIALS`\n environment variable and you are using an API key, the API might return a\n warning telling you that the credentials you provided to ADC are being\n ignored. To stop the warning, unset the `GOOGLE_APPLICATION_CREDENTIALS`\n environment variable.\n\nUnrecognized credential type\n\nIf your API request returns an error that includes `Error creating credential\nfrom JSON. Unrecognized credential type`, make sure you are using a valid\ncredential. Client ID files are not supported to provide credentials for ADC.\n\nError returned for local credentials from service account impersonation\n\nCredentials from a local ADC file generated by using service account\nimpersonation are not supported by all of the authentication libraries. If your\ncall returns an error similar to `Neither metadata server or valid service\naccount credentials are found`, you can't use local impersonated credentials for\nthis task.\n\nTo avoid this error, create your ADC file from your user credentials or run your\ncode in an environment that has a metadata server available (such as\nCompute Engine).\n\nUnknown project `764086051850` used for request\n\nProject `764086051850` is the project used by the gcloud CLI. If you\nsee authentication errors referencing this project, you are trying to use\na client-based API and you have not set both your project and your quota\nproject for your configuration.\n\nFor more information, see [User credentials not working](#user-creds-client-based).\n\nAccess blocked when using scopes\n\nWhen you attempt to create a local ADC file, and an error similar to `This app\nis blocked` or `Access blocked: Authorization Error` is returned, you might be\nattempting to use scopes that aren't supported by the\n[default ADC setup command](/docs/authentication/set-up-adc-local-dev-environment#google-idp). Typically, this issue is caused by\nadding scopes for applications outside of Google Cloud, such as Google\nDrive.\n\n\nBy default, the access tokens generated from a local ADC file created with user credentials include\nthe [cloud-wide scope `https://www.googleapis.com/auth/cloud-platform`](/docs/authentication#authorization-gcp).\nTo specify scopes explicitly, you use the\n[`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)\nwith the `gcloud auth application-default login` command.\n\n\nTo add scopes for services outside of Google Cloud, such as Google Drive,\n[create an OAuth Client ID](https://support.google.com/cloud/answer/6158849)\nand provide it to the `gcloud auth application-default login` command by using the\n[`---client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying\nyour scopes with the [`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)."]]
