사용자 계정으로 구성된 ADC는 추가 구성 단계 없이는 일부 API에서 작동하지 않을 수 있습니다. API가 프로젝트에서 사용 설정되지 않았거나 사용 가능한 할당량 프로젝트가 없다는 오류 메시지가 표시되면 사용자 인증 정보가 작동하지 않음을 참조하세요.
로컬 ADC 파일에는 갱신 토큰이 포함됩니다. 파일 시스템에 액세스할 수 있는 모든 사용자는 이를 사용하여 유효한 액세스 토큰을 가져올 수 있습니다. 이러한 로컬 사용자 인증 정보가 더 이상 필요하지 않으면 gcloud auth application-default revoke 명령어를 사용하여 취소할 수 있습니다.
로컬 ADC 파일은 gcloud CLI 구성이 아닌 사용자 계정과 연결됩니다. 다른 gcloud CLI 구성으로 변경하면 gcloud CLI에서 사용되는 ID가 변경될 수 있지만 로컬 ADC 파일 또는 ADC 구성에 영향을 주지 않습니다.
서비스 계정 사용자 인증 정보
서비스 계정 가장 기능 또는 서비스 계정 키를 사용하여 서비스 계정의 사용자 인증 정보로 ADC를 구성할 수 있습니다.
서비스 계정 가장
서비스 계정 가장을 사용하여 로컬 애플리케이션 기본 사용자 인증 정보(ADC) 파일을 설정할 수 있습니다. 가장을 지원하는 클라이언트 라이브러리는 이러한 사용자 인증 정보를 자동으로 사용할 수 있습니다. 가장을 사용하여 생성된 로컬 ADC 파일은 다음 언어에서 지원됩니다.
C#
Go
Java
Node.js
Python
가장하는 서비스 계정에 대한 서비스 계정 토큰 생성자(roles/iam.serviceAccountTokenCreator) IAM 역할이 있어야 합니다. 자세한 내용은 필요한 역할을 참조하세요.
로컬 개발에 사용자 계정 또는 서비스 계정 가장을 사용할 수 없으면 서비스 계정 키를 사용할 수 있습니다.
서비스 계정 키를 만들고 이를 ADC에 제공하려면 다음 안내를 따르세요.
서비스 계정 키 만들기의 안내에 따라 애플리케이션에 필요한 역할, 서비스 계정에 대한 키를 사용하여 서비스 계정을 만듭니다.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials.
This variable applies only to your current shell session, so if you open
a new session, set the variable again.
Example: Linux or macOS
exportGOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"
Replace KEY_PATH with the path of the JSON file that contains your credentials.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eYou can configure Application Default Credentials (ADC) in a local development environment using either user credentials or service account credentials.\u003c/p\u003e\n"],["\u003cp\u003eTo use user credentials, initialize the Google Cloud CLI with \u003ccode\u003egcloud init\u003c/code\u003e and create local authentication credentials with \u003ccode\u003egcloud auth application-default login\u003c/code\u003e, unless using Cloud Shell.\u003c/p\u003e\n"],["\u003cp\u003eService account impersonation can be used to create a local ADC file, but it requires the Service Account Token Creator role and is only supported in specific languages like C#, Go, Java, Node.js, and Python.\u003c/p\u003e\n"],["\u003cp\u003eService account keys are an alternative to user accounts or service account impersonation, but they pose security risks and require setting the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable.\u003c/p\u003e\n"],["\u003cp\u003eWhen you set the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable, it is checked first by ADC, and then other locations only if necessary.\u003c/p\u003e\n"]]],[],null,["You can provide either [your user credentials](#local-user-cred) or\n[service account credentials](#service-account) to ADC in a local development\nenvironment.\n\nUser credentials\n\nWhen your code is running in a local development environment, such as a\ndevelopment workstation, the best option is to use the credentials associated\nwith your [user account](/docs/authentication#user-accounts).\nHow you configure ADC with your user account depends on whether your [user account](/docs/authentication#user-accounts) is managed by Google---in other words, it is a Google Account---or by another identity provider (IdP), and federated by using [Workforce Identity Federation](/iam/docs/workforce-identity-federation).\n\n\u003cbr /\u003e\n\nGoogle Account\n\nTo configure ADC with a Google Account, you use the Google Cloud CLI:\n\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n | **Note:** To add scopes for services outside of Google Cloud, such as Google Drive, [create an OAuth Client ID](https://support.google.com/cloud/answer/6158849) and provide it to the `gcloud auth application-default login` command by using the [`--client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying your scopes with the [`--scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\n\nExternal IdP\n\n\nTo configure ADC for a user account managed by an external IdP and federated\nwith [Workforce Identity Federation](/iam/docs/workforce-identity-federation):\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\nTips for configuring ADC with your user credentials\n\nWhen you configure ADC with your user account, you should be aware of the\nfollowing facts:\n\n- ADC configured with a user account might not work for some APIs without extra\n configuration steps. If you see an error message about the API not being\n enabled in the project, or that there is no quota project available, see\n [User credentials not working](/docs/authentication/troubleshoot-adc#user-creds-client-based).\n\n- The local ADC file contains your refresh token. Any user with access to your\n file system can use it to get a valid access token. If you no longer need\n these local credentials, you can revoke them by using the\n [`gcloud auth application-default revoke` command](/sdk/gcloud/reference/auth/application-default/revoke).\n\n- Your local ADC file is associated with your user account, not your\n gcloud CLI configuration. Changing to a different\n gcloud CLI configuration might change the identity used by the\n gcloud CLI, but it does not affect your local ADC file or the ADC\n configuration.\n\nService account credentials\n\nYou can configure ADC with credentials from a\n[service account](/docs/authentication#service-accounts) by using service account impersonation or by\nusing a service account key.\n\nService account impersonation\n\n\nYou can use service account impersonation to set up a local Application Default\nCredentials (ADC) file. Client libraries that support impersonation\ncan use those credentials automatically. Local ADC files created by using\nimpersonation are supported in the following languages:\n\n- C#\n- Go\n- Java\n- Node.js\n- Python\n\nYou must have the Service Account Token Creator\n(`roles/iam.serviceAccountTokenCreator`) IAM role on the service account you are\nimpersonating. For more information, see\n[Required roles](/docs/authentication/use-service-account-impersonation#required-roles).\n\n\nUse service account impersonation to create a local ADC file: \n\n```\ngcloud auth application-default login --impersonate-service-account SERVICE_ACCT_EMAIL\n```\n\n\nYou can now use client libraries using the supported languages the same way you would after\nsetting up a local ADC file with user credentials. Credentials are automatically found by the\nauthentication libraries. For more information, see\n[Authenticate for using client libraries](/docs/authentication/client-libraries).\n\n\nCredentials from a local ADC file generated by using service account impersonation are not\nsupported by all of the authentication libraries. For more information, see\n[Error returned for local credentials from service account impersonation](/docs/authentication/troubleshoot-adc#local-impersonated).\n\n\u003cbr /\u003e\n\nService account keys\n\nIf you cannot use a user account or service account impersonation for local\ndevelopment, you can use a service account key.\n\n\n| **Note:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n|\n|\n| If you acquired the service account key from an external source, you must validate it before use.\n| For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n\nTo create a service account key and make it available to ADC:\n\n1. Create a service account with the roles your application needs, and a key for that service account, by following the instructions in [Creating a service account key](/iam/docs/keys-create-delete#creating).\n2.\n Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS`\n to the path of the JSON file that contains your credentials.\n This variable applies only to your current shell session, so if you open\n a new session, set the variable again.\n\n **Example:** Linux or macOS \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"\n ```\n **Example:** Windows\n\n For PowerShell: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"C:\\Users\\username\\Downloads\\service-account-file.json\"\n ```\n\n For command prompt: \n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n| **Note:** When you set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, ADC checks this location first, then checks other locations only if necessary.\n\n\u003cbr /\u003e\n\nWhat's next\n\n- Understand best practices for using [service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n\n- [Authenticate for using Cloud Client Libraries](/docs/authentication/client-libraries).\n\n- [Authenticate for using REST](/docs/authentication/rest).\n\n- Explore [authentication methods](/docs/authentication)."]]
