Application Default Credentials (ADC) 是驗證程式庫用來自動依據應用程式環境尋找憑證的策略。驗證程式庫會將這些憑證提供給 Cloud 用戶端程式庫和 Google API 用戶端程式庫。使用 ADC 時，程式碼可以在開發或實際工作環境中執行，無須變更應用程式驗證 Google Cloud 服務和 API 的方式。
許多 Google Cloud 服務都允許您附加服務帳戶，用於提供用於存取 Google Cloud API 的憑證。如果 ADC 在 GOOGLE_APPLICATION_CREDENTIALS 環境變數或本機 ADC 憑證的已知位置中找不到可用的憑證，就會使用中繼資料伺服器，為執行程式碼的服務取得憑證。
在 Google Cloud的實際工作環境中尋找憑證時，建議使用已連結服務帳戶的憑證。如要使用已連結的服務帳戶，請按照下列步驟操作：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eApplication Default Credentials (ADC) automatically locate credentials for your application based on its environment, allowing it to run in development or production without code changes.\u003c/p\u003e\n"],["\u003cp\u003eADC prioritizes credential locations in a specific order: the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable, a file from the \u003ccode\u003egcloud auth application-default login\u003c/code\u003e command, and lastly, an attached service account through the metadata server.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable can point to credential files for Workforce Identity Federation, Workload Identity Federation, or a service account key, though service account keys are discouraged due to security risks.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud auth application-default login\u003c/code\u003e command creates a local credential file, separate from gcloud CLI credentials, in a specific location that differs based on the operating system.\u003c/p\u003e\n"],["\u003cp\u003eUsing an attached service account, accessible via the metadata server, is the recommended method for credentialing applications in a production Google Cloud environment.\u003c/p\u003e\n"]]],[],null,["This page describes the locations where Application Default Credentials (ADC)\nlooks for credentials. Understanding how ADC works can help you understand which\ncredentials ADC is using, and how it's finding them.\n\n\nApplication Default Credentials (ADC) is a strategy used by the authentication libraries\nto automatically find credentials based on the application environment. The authentication libraries\nmake those credentials available to\n[Cloud Client Libraries and Google API Client Libraries](/apis/docs/client-libraries-explained).\nWhen you use ADC, your code can run in either a development or production environment without\nchanging how your application authenticates to Google Cloud services and APIs.\n\nFor information about how to provide credentials to ADC, including how to\ngenerate a local ADC file, see\n[Set up Application Default Credentials](/docs/authentication/provide-credentials-adc).\n\nSearch order\n\nADC searches for credentials in the following locations:\n\n1. [`GOOGLE_APPLICATION_CREDENTIALS` environment variable](#GAC)\n2. [A credential file created by using the `gcloud auth application-default login` command](#personal)\n3. [The attached service account, returned by the metadata server](#attached-sa)\n\nThe order of the locations ADC checks for credentials is not related to\nthe relative merit of each location. For help with\nunderstanding the best ways to provide credentials to ADC, see\n[Set up Application Default Credentials](/docs/authentication/provide-credentials-adc).\n\nGOOGLE_APPLICATION_CREDENTIALS environment variable\n\nYou can use the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to provide\nthe location of a credential JSON file. This JSON file can be one of the\nfollowing types of files:\n\n- A credential configuration file for Workforce Identity Federation\n\n Workforce Identity Federation lets you use an external identity provider\n (IdP) to authenticate and authorize users to access Google Cloud\n resources. For more information, see\n [Workforce Identity Federation](/iam/docs/workforce-identity-federation) in the\n Identity and Access Management (IAM) documentation.\n- A credential configuration file for Workload Identity Federation\n\n Workload Identity Federation lets you use an external\n IdP to authenticate and authorize workloads to access\n Google Cloud resources. For more information, see\n [Authenticating by using client libraries, the gcloud CLI, or Terraform](/iam/docs/using-workload-identity-federation#generate-automatic)\n in the Identity and Access Management (IAM) documentation.\n- A service account key\n\n Service account keys create a security risk and are not recommended. Unlike\n the other credential file types, compromised service account keys can be\n used by a bad actor without any additional information. For more\n information, see\n [Best practices for using and managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n\nA credential file created by using the `gcloud auth application-default login` command\n\nYou can [provide credentials to ADC](/docs/authentication/set-up-adc-local-dev-environment) by running the\n[`gcloud auth application-default login`](/sdk/gcloud/reference/auth/application-default/login) command. This\ncommand creates a JSON file containing the credentials you provide (either from\nyour user account or from impersonating a service account) and places it in a\nwell-known location on your file system. The location depends on your\noperating system:\n\n- Linux, macOS: `$HOME/.config/gcloud/application_default_credentials.json`\n- Windows: `%APPDATA%\\gcloud\\application_default_credentials.json`\n\nThe credentials you provide to ADC by using the gcloud CLI are\ndistinct from your gcloud credentials---the credentials the\ngcloud CLI uses to authenticate to Google Cloud. For more\ninformation about these two sets of credentials, see\n[gcloud CLI authentication configuration and ADC configuration](/docs/authentication/gcloud#gcloud-credentials).\n\n\nBy default, the access tokens generated from a local ADC file created with user credentials include\nthe [cloud-wide scope `https://www.googleapis.com/auth/cloud-platform`](/docs/authentication#authorization-gcp).\nTo specify scopes explicitly, you use the\n[`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)\nwith the `gcloud auth application-default login` command.\n\n\nTo add scopes for services outside of Google Cloud, such as Google Drive,\n[create an OAuth Client ID](https://support.google.com/cloud/answer/6158849)\nand provide it to the `gcloud auth application-default login` command by using the\n[`---client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying\nyour scopes with the [`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes).\n\n\nThe attached service account\n\nMany Google Cloud services let you attach a service account that can be\nused to provide credentials for accessing Google Cloud APIs. If ADC does\nnot find credentials it can use in either the `GOOGLE_APPLICATION_CREDENTIALS`\nenvironment variable or the well-known location for local ADC credentials,\nit uses the [metadata server](/compute/docs/metadata/overview) to get credentials for the\nservice where the code is running.\n\nUsing the credentials from the attached service account is the preferred method\nfor finding credentials in a production environment on Google Cloud. To\nuse the attached service account, follow these steps:\n\n1. Create a user-managed service account.\n2. Grant that service account the [least privileged](/iam/docs/using-iam-securely#least_privilege) IAM roles possible.\n3. Attach the service account to the resource where your code is running.\n\nFor help with creating a service account, see\n[Creating and managing service accounts](/iam/docs/service-accounts-create). For help with attaching\na service account, see [Attaching a service account to a resource](/iam/docs/attach-service-accounts#attaching-to-resources).\nFor help with determining the required IAM roles for your service\naccount, see [Choose predefined roles](/iam/docs/choose-predefined-roles).\n\nWhat's next\n\n- Learn the best ways to [provide credentials to ADC](/docs/authentication/provide-credentials-adc).\n- [Authenticate using the Cloud Client Libraries](/docs/authentication/client-libraries).\n- Explore [authentication methods](/docs/authentication).\n- Learn about [client libraries](/apis/docs/client-libraries-explained)."]]
