Quando il codice viene eseguito in un ambiente di sviluppo locale, ad esempio una
workstation di sviluppo, l'opzione migliore è utilizzare le credenziali associate
al tuo account utente.
Il modo in cui configuri ADC con il tuo account utente dipende dal fatto che il tuo
account utente sia gestito da Google, ovvero sia un
Account Google, o da un altro provider di identità (IdP) e federato tramite
l'utilizzo della federazione delle identità per la forza lavoro.
Account Google
Per configurare ADC con un Account Google, utilizza Google Cloud CLI:
Suggerimenti per configurare ADC con le credenziali utente
Quando configuri ADC con il tuo account utente, devi tenere presente
quanto segue:
ADC configurato con un account utente potrebbe non funzionare per alcune API senza passaggi di configurazione aggiuntivi. Se visualizzi un messaggio di errore che indica che l'API non è
abilitata nel progetto o che non è disponibile alcun progetto di quota, consulta
Le credenziali utente non funzionano.
Il file ADC locale contiene il token di aggiornamento. Qualsiasi utente con accesso al tuo
file system può utilizzarlo per ottenere un token di accesso valido. Se non hai più bisogno di queste credenziali locali, puoi revocarle utilizzando il comando gcloud auth application-default revoke.
Il file ADC locale è associato al tuo account utente, non alla configurazione gcloud CLI. Il passaggio a una configurazione diversa di gcloud CLI potrebbe modificare l'identità utilizzata da gcloud CLI, ma non influisce sul file ADC locale o sulla configurazione ADC.
Credenziali del service account
Puoi configurare ADC con le credenziali di un service account utilizzando la simulazione dell'identità del account di servizio o una chiave del account di servizio.
Simulazione dell'identità dei service account
Puoi utilizzare la simulazione dell'identità del account di servizio per configurare un file delle credenziali predefinite dell'applicazione (ADC) locale. Le librerie client che supportano l'impersonificazione
possono utilizzare automaticamente queste credenziali. I file ADC locali creati utilizzando
la simulazione dell'identità sono supportati nelle seguenti lingue:
C#
Vai
Java
Node.js
Python
Devi disporre del ruolo IAM Creatore token service account
(roles/iam.serviceAccountTokenCreator) per il account di servizio che stai
rappresentando. Per saperne di più, consulta
Ruoli richiesti.
Utilizza la simulazione dell'identità del account di servizio per creare un file ADC locale:
Ora puoi utilizzare le librerie client utilizzando le lingue supportate nello stesso modo in cui le utilizzeresti dopo aver configurato un file ADC locale con le credenziali utente. Le credenziali vengono trovate automaticamente dalle
librerie di autenticazione. Per saperne di più, vedi
Autenticarsi per utilizzare le librerie client.
Se non puoi utilizzare l'account utente o la rappresentazione del account di servizio per lo sviluppo locale, puoi utilizzare una chiave del account di servizio.
Per creare una chiave dell'account di servizio e renderla disponibile per ADC:
Crea un account di servizio con i ruoli necessari per la tua applicazione e una chiave
per questo account di servizio seguendo le istruzioni riportate in
Creare una account di servizio account.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials.
This variable applies only to your current shell session, so if you open
a new session, set the variable again.
Example: Linux or macOS
exportGOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"
Replace KEY_PATH with the path of the JSON file that contains your credentials.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eYou can configure Application Default Credentials (ADC) in a local development environment using either user credentials or service account credentials.\u003c/p\u003e\n"],["\u003cp\u003eTo use user credentials, initialize the Google Cloud CLI with \u003ccode\u003egcloud init\u003c/code\u003e and create local authentication credentials with \u003ccode\u003egcloud auth application-default login\u003c/code\u003e, unless using Cloud Shell.\u003c/p\u003e\n"],["\u003cp\u003eService account impersonation can be used to create a local ADC file, but it requires the Service Account Token Creator role and is only supported in specific languages like C#, Go, Java, Node.js, and Python.\u003c/p\u003e\n"],["\u003cp\u003eService account keys are an alternative to user accounts or service account impersonation, but they pose security risks and require setting the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable.\u003c/p\u003e\n"],["\u003cp\u003eWhen you set the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable, it is checked first by ADC, and then other locations only if necessary.\u003c/p\u003e\n"]]],[],null,["You can provide either [your user credentials](#local-user-cred) or\n[service account credentials](#service-account) to ADC in a local development\nenvironment.\n\nUser credentials\n\nWhen your code is running in a local development environment, such as a\ndevelopment workstation, the best option is to use the credentials associated\nwith your [user account](/docs/authentication#user-accounts).\nHow you configure ADC with your user account depends on whether your [user account](/docs/authentication#user-accounts) is managed by Google---in other words, it is a Google Account---or by another identity provider (IdP), and federated by using [Workforce Identity Federation](/iam/docs/workforce-identity-federation).\n\n\u003cbr /\u003e\n\nGoogle Account\n\nTo configure ADC with a Google Account, you use the Google Cloud CLI:\n\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n | **Note:** To add scopes for services outside of Google Cloud, such as Google Drive, [create an OAuth Client ID](https://support.google.com/cloud/answer/6158849) and provide it to the `gcloud auth application-default login` command by using the [`--client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying your scopes with the [`--scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\n\nExternal IdP\n\n\nTo configure ADC for a user account managed by an external IdP and federated\nwith [Workforce Identity Federation](/iam/docs/workforce-identity-federation):\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\nTips for configuring ADC with your user credentials\n\nWhen you configure ADC with your user account, you should be aware of the\nfollowing facts:\n\n- ADC configured with a user account might not work for some APIs without extra\n configuration steps. If you see an error message about the API not being\n enabled in the project, or that there is no quota project available, see\n [User credentials not working](/docs/authentication/troubleshoot-adc#user-creds-client-based).\n\n- The local ADC file contains your refresh token. Any user with access to your\n file system can use it to get a valid access token. If you no longer need\n these local credentials, you can revoke them by using the\n [`gcloud auth application-default revoke` command](/sdk/gcloud/reference/auth/application-default/revoke).\n\n- Your local ADC file is associated with your user account, not your\n gcloud CLI configuration. Changing to a different\n gcloud CLI configuration might change the identity used by the\n gcloud CLI, but it does not affect your local ADC file or the ADC\n configuration.\n\nService account credentials\n\nYou can configure ADC with credentials from a\n[service account](/docs/authentication#service-accounts) by using service account impersonation or by\nusing a service account key.\n\nService account impersonation\n\n\nYou can use service account impersonation to set up a local Application Default\nCredentials (ADC) file. Client libraries that support impersonation\ncan use those credentials automatically. Local ADC files created by using\nimpersonation are supported in the following languages:\n\n- C#\n- Go\n- Java\n- Node.js\n- Python\n\nYou must have the Service Account Token Creator\n(`roles/iam.serviceAccountTokenCreator`) IAM role on the service account you are\nimpersonating. For more information, see\n[Required roles](/docs/authentication/use-service-account-impersonation#required-roles).\n\n\nUse service account impersonation to create a local ADC file: \n\n```\ngcloud auth application-default login --impersonate-service-account SERVICE_ACCT_EMAIL\n```\n\n\nYou can now use client libraries using the supported languages the same way you would after\nsetting up a local ADC file with user credentials. Credentials are automatically found by the\nauthentication libraries. For more information, see\n[Authenticate for using client libraries](/docs/authentication/client-libraries).\n\n\nCredentials from a local ADC file generated by using service account impersonation are not\nsupported by all of the authentication libraries. For more information, see\n[Error returned for local credentials from service account impersonation](/docs/authentication/troubleshoot-adc#local-impersonated).\n\n\u003cbr /\u003e\n\nService account keys\n\nIf you cannot use a user account or service account impersonation for local\ndevelopment, you can use a service account key.\n\n\n| **Note:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n|\n|\n| If you acquired the service account key from an external source, you must validate it before use.\n| For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n\nTo create a service account key and make it available to ADC:\n\n1. Create a service account with the roles your application needs, and a key for that service account, by following the instructions in [Creating a service account key](/iam/docs/keys-create-delete#creating).\n2.\n Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS`\n to the path of the JSON file that contains your credentials.\n This variable applies only to your current shell session, so if you open\n a new session, set the variable again.\n\n **Example:** Linux or macOS \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"\n ```\n **Example:** Windows\n\n For PowerShell: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"C:\\Users\\username\\Downloads\\service-account-file.json\"\n ```\n\n For command prompt: \n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n| **Note:** When you set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, ADC checks this location first, then checks other locations only if necessary.\n\n\u003cbr /\u003e\n\nWhat's next\n\n- Understand best practices for using [service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n\n- [Authenticate for using Cloud Client Libraries](/docs/authentication/client-libraries).\n\n- [Authenticate for using REST](/docs/authentication/rest).\n\n- Explore [authentication methods](/docs/authentication)."]]
