Application Default Credentials (ADC) は、アプリケーション環境に基づいて認証情報を自動的に検索するために、認証ライブラリが使用する手法です。認証ライブラリは、これらの認証情報を Cloud クライアント ライブラリと Google API クライアント ライブラリで使用可能にします。ADC を使用すると、アプリケーションが Google Cloud サービスと API に対して認証を行う方法を変更せずに、開発環境または本番環境でコードを実行できます。
Workforce Identity 連携を使用すると、外部 ID プロバイダ（IdP）を使用して、 Google Cloudリソースにアクセスするユーザーを認証および認可できます。詳細については、Identity and Access Management（IAM）ドキュメントの Workforce Identity 連携をご覧ください。
Google Cloud サービスの多くは、 Google Cloud API にアクセスするための認証情報を提供するサービス アカウントを追加できます。ADC が GOOGLE_APPLICATION_CREDENTIALS 環境変数、またはローカル ADC 認証情報の既知の場所で使用できる認証情報を検出しない場合は、ADC はメタデータ サーバーを使用して、コードが実行されているサービスの認証情報を取得します。
Google Cloudの本番環境内で認証情報を見つける場合、接続されたサービス アカウントの認証情報を使用することが推奨の方法です。接続されたサービス アカウントを使用する手順は次のとおりです。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eApplication Default Credentials (ADC) automatically locate credentials for your application based on its environment, allowing it to run in development or production without code changes.\u003c/p\u003e\n"],["\u003cp\u003eADC prioritizes credential locations in a specific order: the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable, a file from the \u003ccode\u003egcloud auth application-default login\u003c/code\u003e command, and lastly, an attached service account through the metadata server.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable can point to credential files for Workforce Identity Federation, Workload Identity Federation, or a service account key, though service account keys are discouraged due to security risks.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud auth application-default login\u003c/code\u003e command creates a local credential file, separate from gcloud CLI credentials, in a specific location that differs based on the operating system.\u003c/p\u003e\n"],["\u003cp\u003eUsing an attached service account, accessible via the metadata server, is the recommended method for credentialing applications in a production Google Cloud environment.\u003c/p\u003e\n"]]],[],null,["This page describes the locations where Application Default Credentials (ADC)\nlooks for credentials. Understanding how ADC works can help you understand which\ncredentials ADC is using, and how it's finding them.\n\n\nApplication Default Credentials (ADC) is a strategy used by the authentication libraries\nto automatically find credentials based on the application environment. The authentication libraries\nmake those credentials available to\n[Cloud Client Libraries and Google API Client Libraries](/apis/docs/client-libraries-explained).\nWhen you use ADC, your code can run in either a development or production environment without\nchanging how your application authenticates to Google Cloud services and APIs.\n\nFor information about how to provide credentials to ADC, including how to\ngenerate a local ADC file, see\n[Set up Application Default Credentials](/docs/authentication/provide-credentials-adc).\n\nSearch order\n\nADC searches for credentials in the following locations:\n\n1. [`GOOGLE_APPLICATION_CREDENTIALS` environment variable](#GAC)\n2. [A credential file created by using the `gcloud auth application-default login` command](#personal)\n3. [The attached service account, returned by the metadata server](#attached-sa)\n\nThe order of the locations ADC checks for credentials is not related to\nthe relative merit of each location. For help with\nunderstanding the best ways to provide credentials to ADC, see\n[Set up Application Default Credentials](/docs/authentication/provide-credentials-adc).\n\nGOOGLE_APPLICATION_CREDENTIALS environment variable\n\nYou can use the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to provide\nthe location of a credential JSON file. This JSON file can be one of the\nfollowing types of files:\n\n- A credential configuration file for Workforce Identity Federation\n\n Workforce Identity Federation lets you use an external identity provider\n (IdP) to authenticate and authorize users to access Google Cloud\n resources. For more information, see\n [Workforce Identity Federation](/iam/docs/workforce-identity-federation) in the\n Identity and Access Management (IAM) documentation.\n- A credential configuration file for Workload Identity Federation\n\n Workload Identity Federation lets you use an external\n IdP to authenticate and authorize workloads to access\n Google Cloud resources. For more information, see\n [Authenticating by using client libraries, the gcloud CLI, or Terraform](/iam/docs/using-workload-identity-federation#generate-automatic)\n in the Identity and Access Management (IAM) documentation.\n- A service account key\n\n Service account keys create a security risk and are not recommended. Unlike\n the other credential file types, compromised service account keys can be\n used by a bad actor without any additional information. For more\n information, see\n [Best practices for using and managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n\nA credential file created by using the `gcloud auth application-default login` command\n\nYou can [provide credentials to ADC](/docs/authentication/set-up-adc-local-dev-environment) by running the\n[`gcloud auth application-default login`](/sdk/gcloud/reference/auth/application-default/login) command. This\ncommand creates a JSON file containing the credentials you provide (either from\nyour user account or from impersonating a service account) and places it in a\nwell-known location on your file system. The location depends on your\noperating system:\n\n- Linux, macOS: `$HOME/.config/gcloud/application_default_credentials.json`\n- Windows: `%APPDATA%\\gcloud\\application_default_credentials.json`\n\nThe credentials you provide to ADC by using the gcloud CLI are\ndistinct from your gcloud credentials---the credentials the\ngcloud CLI uses to authenticate to Google Cloud. For more\ninformation about these two sets of credentials, see\n[gcloud CLI authentication configuration and ADC configuration](/docs/authentication/gcloud#gcloud-credentials).\n\n\nBy default, the access tokens generated from a local ADC file created with user credentials include\nthe [cloud-wide scope `https://www.googleapis.com/auth/cloud-platform`](/docs/authentication#authorization-gcp).\nTo specify scopes explicitly, you use the\n[`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)\nwith the `gcloud auth application-default login` command.\n\n\nTo add scopes for services outside of Google Cloud, such as Google Drive,\n[create an OAuth Client ID](https://support.google.com/cloud/answer/6158849)\nand provide it to the `gcloud auth application-default login` command by using the\n[`---client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying\nyour scopes with the [`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes).\n\n\nThe attached service account\n\nMany Google Cloud services let you attach a service account that can be\nused to provide credentials for accessing Google Cloud APIs. If ADC does\nnot find credentials it can use in either the `GOOGLE_APPLICATION_CREDENTIALS`\nenvironment variable or the well-known location for local ADC credentials,\nit uses the [metadata server](/compute/docs/metadata/overview) to get credentials for the\nservice where the code is running.\n\nUsing the credentials from the attached service account is the preferred method\nfor finding credentials in a production environment on Google Cloud. To\nuse the attached service account, follow these steps:\n\n1. Create a user-managed service account.\n2. Grant that service account the [least privileged](/iam/docs/using-iam-securely#least_privilege) IAM roles possible.\n3. Attach the service account to the resource where your code is running.\n\nFor help with creating a service account, see\n[Creating and managing service accounts](/iam/docs/service-accounts-create). For help with attaching\na service account, see [Attaching a service account to a resource](/iam/docs/attach-service-accounts#attaching-to-resources).\nFor help with determining the required IAM roles for your service\naccount, see [Choose predefined roles](/iam/docs/choose-predefined-roles).\n\nWhat's next\n\n- Learn the best ways to [provide credentials to ADC](/docs/authentication/provide-credentials-adc).\n- [Authenticate using the Cloud Client Libraries](/docs/authentication/client-libraries).\n- Explore [authentication methods](/docs/authentication).\n- Learn about [client libraries](/apis/docs/client-libraries-explained)."]]
