Quando seu código está sendo executado em um ambiente de desenvolvimento local, como uma
estação de trabalho de desenvolvimento, a melhor opção é usar as credenciais associadas
à sua conta de usuário.
A configuração do ADC com sua conta de usuário depende de a
conta de usuário ser gerenciada pelo Google (em outras palavras, é uma
Conta do Google) ou por outro provedor de identidade (IdP). e federadas usando
a federação de identidade de colaboradores.
Conta do Google
Para configurar o ADC com uma Conta do Google, use a CLI do Google Cloud:
Dicas para configurar o ADC com suas credenciais de usuário
Ao configurar o ADC com sua conta de usuário, é importante
estar ciente dos seguintes fatos:
O ADC configurado com uma conta de usuário pode não funcionar para algumas APIs sem etapas de configuração extras. Se você receber uma mensagem de erro informando que a API não está ativada no projeto ou que não há projeto de cota disponível, consulte As credenciais do usuário não estão funcionando.
O arquivo ADC local contém o token de atualização. Qualquer usuário com acesso ao seu
sistema de arquivos pode usá-lo para receber um token de acesso válido. Se você não precisar mais dessas credenciais locais, poderá revogá-las usando o comando gcloud auth application-default revoke.
Seu arquivo ADC local está associado à sua conta de usuário, não à sua configuração da CLI do gcloud. Alterar para uma configuração
diferente da CLI gcloud pode mudar a identidade usada pela
CLI gcloud, mas isso não afeta o arquivo ADC local ou a configuração
do ADC.
Credenciais da conta de serviço
É possível configurar o ADC com credenciais de uma
conta de serviço usando a representação da conta de serviço ou uma
chave de conta de serviço.
Representação da conta de serviço:
É possível usar a representação de conta de serviço para configurar um arquivo local Application Default Credentials (ADC). As bibliotecas de cliente compatíveis com a representação podem usar essas credenciais automaticamente. Os arquivos ADC locais criados com a representação são compatíveis com os seguintes idiomas:
C#
Go
Java
Node.js
Python
Você precisa ter o papel do IAM "Criador de token da conta de serviço" (roles/iam.serviceAccountTokenCreator) na conta de serviço que está representando. Para mais informações, consulte
Papéis necessários.
Use a representação de conta de serviço para criar um arquivo ADC local:
Agora é possível usar bibliotecas de cliente com as linguagens compatíveis da mesma forma que você faria depois de
configurar um arquivo local do ADC com credenciais de usuário. As credenciais são encontradas automaticamente pelas
bibliotecas de autenticação. Para mais informações, consulte Autenticar para usar bibliotecas de cliente.
Se não for possível usar uma conta de usuário ou a representação de uma conta de serviço para desenvolvimento local, use uma chave de conta de serviço.
Para criar uma chave de conta de serviço e disponibilizá-la para o ADC, faça o seguinte:
Crie uma conta de serviço com os papéis de que seu aplicativo precisa e uma chave para essa conta de serviço. Para fazer isso, siga as instruções em Como criar uma chave de conta de serviço.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials.
This variable applies only to your current shell session, so if you open
a new session, set the variable again.
Example: Linux or macOS
exportGOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"
Replace KEY_PATH with the path of the JSON file that contains your credentials.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-25 UTC."],[[["\u003cp\u003eYou can configure Application Default Credentials (ADC) in a local development environment using either user credentials or service account credentials.\u003c/p\u003e\n"],["\u003cp\u003eTo use user credentials, initialize the Google Cloud CLI with \u003ccode\u003egcloud init\u003c/code\u003e and create local authentication credentials with \u003ccode\u003egcloud auth application-default login\u003c/code\u003e, unless using Cloud Shell.\u003c/p\u003e\n"],["\u003cp\u003eService account impersonation can be used to create a local ADC file, but it requires the Service Account Token Creator role and is only supported in specific languages like C#, Go, Java, Node.js, and Python.\u003c/p\u003e\n"],["\u003cp\u003eService account keys are an alternative to user accounts or service account impersonation, but they pose security risks and require setting the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable.\u003c/p\u003e\n"],["\u003cp\u003eWhen you set the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable, it is checked first by ADC, and then other locations only if necessary.\u003c/p\u003e\n"]]],[],null,["# Set up ADC for a local development environment\n\nYou can provide either [your user credentials](#local-user-cred) or\n[service account credentials](#service-account) to ADC in a local development\nenvironment.\n\nUser credentials\n----------------\n\nWhen your code is running in a local development environment, such as a\ndevelopment workstation, the best option is to use the credentials associated\nwith your [user account](/docs/authentication#user-accounts).\nHow you configure ADC with your user account depends on whether your [user account](/docs/authentication#user-accounts) is managed by Google---in other words, it is a Google Account---or by another identity provider (IdP), and federated by using [Workforce Identity Federation](/iam/docs/workforce-identity-federation).\n\n\u003cbr /\u003e\n\n### Google Account\n\nTo configure ADC with a Google Account, you use the Google Cloud CLI:\n\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n | **Note:** To add scopes for services outside of Google Cloud, such as Google Drive, [create an OAuth Client ID](https://support.google.com/cloud/answer/6158849) and provide it to the `gcloud auth application-default login` command by using the [`--client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying your scopes with the [`--scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\n\n### External IdP\n\n\nTo configure ADC for a user account managed by an external IdP and federated\nwith [Workforce Identity Federation](/iam/docs/workforce-identity-federation):\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\n### Tips for configuring ADC with your user credentials\n\nWhen you configure ADC with your user account, you should be aware of the\nfollowing facts:\n\n- ADC configured with a user account might not work for some APIs without extra\n configuration steps. If you see an error message about the API not being\n enabled in the project, or that there is no quota project available, see\n [User credentials not working](/docs/authentication/troubleshoot-adc#user-creds-client-based).\n\n- The local ADC file contains your refresh token. Any user with access to your\n file system can use it to get a valid access token. If you no longer need\n these local credentials, you can revoke them by using the\n [`gcloud auth application-default revoke` command](/sdk/gcloud/reference/auth/application-default/revoke).\n\n- Your local ADC file is associated with your user account, not your\n gcloud CLI configuration. Changing to a different\n gcloud CLI configuration might change the identity used by the\n gcloud CLI, but it does not affect your local ADC file or the ADC\n configuration.\n\nService account credentials\n---------------------------\n\nYou can configure ADC with credentials from a\n[service account](/docs/authentication#service-accounts) by using service account impersonation or by\nusing a service account key.\n\n### Service account impersonation\n\n\nYou can use service account impersonation to set up a local Application Default\nCredentials (ADC) file. Client libraries that support impersonation\ncan use those credentials automatically. Local ADC files created by using\nimpersonation are supported in the following languages:\n\n- C#\n- Go\n- Java\n- Node.js\n- Python\n\nYou must have the Service Account Token Creator\n(`roles/iam.serviceAccountTokenCreator`) IAM role on the service account you are\nimpersonating. For more information, see\n[Required roles](/docs/authentication/use-service-account-impersonation#required-roles).\n\n\nUse service account impersonation to create a local ADC file: \n\n```\ngcloud auth application-default login --impersonate-service-account SERVICE_ACCT_EMAIL\n```\n\n\nYou can now use client libraries using the supported languages the same way you would after\nsetting up a local ADC file with user credentials. Credentials are automatically found by the\nauthentication libraries. For more information, see\n[Authenticate for using client libraries](/docs/authentication/client-libraries).\n\n\nCredentials from a local ADC file generated by using service account impersonation are not\nsupported by all of the authentication libraries. For more information, see\n[Error returned for local credentials from service account impersonation](/docs/authentication/troubleshoot-adc#local-impersonated).\n\n\u003cbr /\u003e\n\n### Service account keys\n\nIf you cannot use a user account or service account impersonation for local\ndevelopment, you can use a service account key.\n\n\n| **Note:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n|\n|\n| If you acquired the service account key from an external source, you must validate it before use.\n| For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n\nTo create a service account key and make it available to ADC:\n\n1. Create a service account with the roles your application needs, and a key for that service account, by following the instructions in [Creating a service account key](/iam/docs/keys-create-delete#creating).\n2. \n3.\n Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS`\n to the path of the JSON file that contains your credentials.\n This variable applies only to your current shell session, so if you open\n a new session, set the variable again.\n\n **Example:** Linux or macOS \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"\n ```\n **Example:** Windows\n\n For PowerShell: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"C:\\Users\\username\\Downloads\\service-account-file.json\"\n ```\n\n For command prompt: \n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n| **Note:** When you set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, ADC checks this location first, then checks other locations only if necessary.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n- Understand best practices for using [service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n\n- [Authenticate for using Cloud Client Libraries](/docs/authentication/client-libraries).\n\n- [Authenticate for using REST](/docs/authentication/rest).\n\n- Explore [authentication methods](/docs/authentication)."]]
