Application Default Credentials (ADC) 是身份验证库使用的一种策略，可根据应用环境自动查找凭据。身份验证库会将这些凭据提供给 Cloud 客户端库和 Google API 客户端库。使用 ADC 时，您的代码可以在开发或生产环境中运行，而无需更改应用向 Google Cloud 服务和 API 进行身份验证的方式。
许多 Google Cloud 服务可让您关联服务账号，该账号可用于为访问 Google Cloud API 提供凭据。如果 ADC 未找到可在 GOOGLE_APPLICATION_CREDENTIALS 环境变量或本地 ADC 凭据的熟知位置使用的凭据，则会使用元数据服务器获取代码运行的服务的凭据。
如需查找 Google Cloud上生产环境中的凭据，首选方法是使用关联的服务账号中的凭据。如需使用关联的服务账号，请按照以下步骤操作：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eApplication Default Credentials (ADC) automatically locate credentials for your application based on its environment, allowing it to run in development or production without code changes.\u003c/p\u003e\n"],["\u003cp\u003eADC prioritizes credential locations in a specific order: the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable, a file from the \u003ccode\u003egcloud auth application-default login\u003c/code\u003e command, and lastly, an attached service account through the metadata server.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable can point to credential files for Workforce Identity Federation, Workload Identity Federation, or a service account key, though service account keys are discouraged due to security risks.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud auth application-default login\u003c/code\u003e command creates a local credential file, separate from gcloud CLI credentials, in a specific location that differs based on the operating system.\u003c/p\u003e\n"],["\u003cp\u003eUsing an attached service account, accessible via the metadata server, is the recommended method for credentialing applications in a production Google Cloud environment.\u003c/p\u003e\n"]]],[],null,["This page describes the locations where Application Default Credentials (ADC)\nlooks for credentials. Understanding how ADC works can help you understand which\ncredentials ADC is using, and how it's finding them.\n\n\nApplication Default Credentials (ADC) is a strategy used by the authentication libraries\nto automatically find credentials based on the application environment. The authentication libraries\nmake those credentials available to\n[Cloud Client Libraries and Google API Client Libraries](/apis/docs/client-libraries-explained).\nWhen you use ADC, your code can run in either a development or production environment without\nchanging how your application authenticates to Google Cloud services and APIs.\n\nFor information about how to provide credentials to ADC, including how to\ngenerate a local ADC file, see\n[Set up Application Default Credentials](/docs/authentication/provide-credentials-adc).\n\nSearch order\n\nADC searches for credentials in the following locations:\n\n1. [`GOOGLE_APPLICATION_CREDENTIALS` environment variable](#GAC)\n2. [A credential file created by using the `gcloud auth application-default login` command](#personal)\n3. [The attached service account, returned by the metadata server](#attached-sa)\n\nThe order of the locations ADC checks for credentials is not related to\nthe relative merit of each location. For help with\nunderstanding the best ways to provide credentials to ADC, see\n[Set up Application Default Credentials](/docs/authentication/provide-credentials-adc).\n\nGOOGLE_APPLICATION_CREDENTIALS environment variable\n\nYou can use the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to provide\nthe location of a credential JSON file. This JSON file can be one of the\nfollowing types of files:\n\n- A credential configuration file for Workforce Identity Federation\n\n Workforce Identity Federation lets you use an external identity provider\n (IdP) to authenticate and authorize users to access Google Cloud\n resources. For more information, see\n [Workforce Identity Federation](/iam/docs/workforce-identity-federation) in the\n Identity and Access Management (IAM) documentation.\n- A credential configuration file for Workload Identity Federation\n\n Workload Identity Federation lets you use an external\n IdP to authenticate and authorize workloads to access\n Google Cloud resources. For more information, see\n [Authenticating by using client libraries, the gcloud CLI, or Terraform](/iam/docs/using-workload-identity-federation#generate-automatic)\n in the Identity and Access Management (IAM) documentation.\n- A service account key\n\n Service account keys create a security risk and are not recommended. Unlike\n the other credential file types, compromised service account keys can be\n used by a bad actor without any additional information. For more\n information, see\n [Best practices for using and managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n\nA credential file created by using the `gcloud auth application-default login` command\n\nYou can [provide credentials to ADC](/docs/authentication/set-up-adc-local-dev-environment) by running the\n[`gcloud auth application-default login`](/sdk/gcloud/reference/auth/application-default/login) command. This\ncommand creates a JSON file containing the credentials you provide (either from\nyour user account or from impersonating a service account) and places it in a\nwell-known location on your file system. The location depends on your\noperating system:\n\n- Linux, macOS: `$HOME/.config/gcloud/application_default_credentials.json`\n- Windows: `%APPDATA%\\gcloud\\application_default_credentials.json`\n\nThe credentials you provide to ADC by using the gcloud CLI are\ndistinct from your gcloud credentials---the credentials the\ngcloud CLI uses to authenticate to Google Cloud. For more\ninformation about these two sets of credentials, see\n[gcloud CLI authentication configuration and ADC configuration](/docs/authentication/gcloud#gcloud-credentials).\n\n\nBy default, the access tokens generated from a local ADC file created with user credentials include\nthe [cloud-wide scope `https://www.googleapis.com/auth/cloud-platform`](/docs/authentication#authorization-gcp).\nTo specify scopes explicitly, you use the\n[`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)\nwith the `gcloud auth application-default login` command.\n\n\nTo add scopes for services outside of Google Cloud, such as Google Drive,\n[create an OAuth Client ID](https://support.google.com/cloud/answer/6158849)\nand provide it to the `gcloud auth application-default login` command by using the\n[`---client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying\nyour scopes with the [`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes).\n\n\nThe attached service account\n\nMany Google Cloud services let you attach a service account that can be\nused to provide credentials for accessing Google Cloud APIs. If ADC does\nnot find credentials it can use in either the `GOOGLE_APPLICATION_CREDENTIALS`\nenvironment variable or the well-known location for local ADC credentials,\nit uses the [metadata server](/compute/docs/metadata/overview) to get credentials for the\nservice where the code is running.\n\nUsing the credentials from the attached service account is the preferred method\nfor finding credentials in a production environment on Google Cloud. To\nuse the attached service account, follow these steps:\n\n1. Create a user-managed service account.\n2. Grant that service account the [least privileged](/iam/docs/using-iam-securely#least_privilege) IAM roles possible.\n3. Attach the service account to the resource where your code is running.\n\nFor help with creating a service account, see\n[Creating and managing service accounts](/iam/docs/service-accounts-create). For help with attaching\na service account, see [Attaching a service account to a resource](/iam/docs/attach-service-accounts#attaching-to-resources).\nFor help with determining the required IAM roles for your service\naccount, see [Choose predefined roles](/iam/docs/choose-predefined-roles).\n\nWhat's next\n\n- Learn the best ways to [provide credentials to ADC](/docs/authentication/provide-credentials-adc).\n- [Authenticate using the Cloud Client Libraries](/docs/authentication/client-libraries).\n- Explore [authentication methods](/docs/authentication).\n- Learn about [client libraries](/apis/docs/client-libraries-explained)."]]
