Cuando tu código se ejecuta en un entorno de desarrollo local, como una estación de trabajo de desarrollo, la mejor opción es usar las credenciales asociadas con tu cuenta de usuario.
La forma de configurar ADC con tu cuenta de usuario depende de si tu cuenta de usuario es administrada por Google (en otras palabras, es una Cuenta de Google) o por otro proveedor de identidad (IdP), y si es federada mediante Workforce Identity Federation.
Cuenta de Google
Para configurar ADC con una Cuenta de Google, usa Google Cloud CLI:
Para configurar ADC para una cuenta de usuario administrada por un IdP externo y federada con la federación de identidades de personal, haz lo siguiente:
Instala Google Cloud CLI.
Después de la instalación,
inicializa Google Cloud CLI ejecutando el siguiente comando:
Sugerencias para configurar ADC con tus credenciales de usuario
Cuando configures ADC con tu cuenta de usuario, debes tener en cuenta los siguientes datos:
Es posible que ADC configurado con una cuenta de usuario no funcione con algunas APIs sin pasos de configuración adicionales. Si ves un mensaje de error en el que se indica que la API no está habilitada en el proyecto o que no hay ningún proyecto de cuota disponible, consulta Las credenciales de usuario no funcionan.
El archivo local de ADC contiene tu token de actualización. Cualquier usuario con acceso a tu sistema de archivos puede usarlo para obtener un token de acceso válido. Si ya no necesitas estas credenciales locales, puedes revocarlas con el comando gcloud auth application-default revoke.
El archivo de ADC local está asociado con tu cuenta de usuario, no con la configuración de la CLI de gcloud. Cambiar a una configuración de gcloud CLI diferente podría cambiar la identidad que usa gcloud CLI, pero no afecta el archivo de ADC local ni la configuración de ADC.
Credenciales de cuenta de servicio
Puedes configurar ADC con credenciales de una cuenta de servicio usando la identidad temporal como cuenta de servicio o una clave de cuenta de servicio.
Uso de identidad temporal como cuenta de servicio
Puedes usar la identidad de una cuenta de servicio para configurar un archivo de credenciales predeterminadas de la aplicación (ADC) local. Las bibliotecas cliente que admiten el uso de identidad pueden utilizar esas credenciales automáticamente. Los archivos de ADC locales creados mediante el uso de identidad se admiten en los siguientes idiomas:
C#
Go
Java
Node.js
Python
Debes tener el rol de IAM de creador de tokens de cuentas de servicio (roles/iam.serviceAccountTokenCreator) en la cuenta de servicio que suplantas. Para obtener más información, consulta los Roles requeridos.
Usa la identidad de la cuenta de servicio para crear un archivo de ADC local:
Ahora puedes usar bibliotecas cliente con los idiomas admitidos de la misma manera que lo harías después de configurar un archivo ADC local con credenciales de usuario. Las bibliotecas de autenticación encuentran las credenciales automáticamente. Si deseas obtener más información, consulta Autentícate para usar las bibliotecas cliente.
Si no puedes usar una cuenta de usuario o la identidad temporal como cuenta de servicio para el desarrollo local, puedes usar una clave de cuenta de servicio.
A fin de crear una clave de cuenta de servicio y hacer que esté disponible para las ADC, haz lo siguiente:
Crea una cuenta de servicio con los roles que necesita tu aplicación y una clave
para esa cuenta de servicio. Para ello, sigue las instrucciones en
Crea una clave de cuenta de servicio.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS
to the path of the JSON file that contains your credentials.
This variable applies only to your current shell session, so if you open
a new session, set the variable again.
Example: Linux or macOS
exportGOOGLE_APPLICATION_CREDENTIALS="KEY_PATH"
Replace KEY_PATH with the path of the JSON file that contains your credentials.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[[["\u003cp\u003eYou can configure Application Default Credentials (ADC) in a local development environment using either user credentials or service account credentials.\u003c/p\u003e\n"],["\u003cp\u003eTo use user credentials, initialize the Google Cloud CLI with \u003ccode\u003egcloud init\u003c/code\u003e and create local authentication credentials with \u003ccode\u003egcloud auth application-default login\u003c/code\u003e, unless using Cloud Shell.\u003c/p\u003e\n"],["\u003cp\u003eService account impersonation can be used to create a local ADC file, but it requires the Service Account Token Creator role and is only supported in specific languages like C#, Go, Java, Node.js, and Python.\u003c/p\u003e\n"],["\u003cp\u003eService account keys are an alternative to user accounts or service account impersonation, but they pose security risks and require setting the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable.\u003c/p\u003e\n"],["\u003cp\u003eWhen you set the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable, it is checked first by ADC, and then other locations only if necessary.\u003c/p\u003e\n"]]],[],null,["You can provide either [your user credentials](#local-user-cred) or\n[service account credentials](#service-account) to ADC in a local development\nenvironment.\n\nUser credentials\n\nWhen your code is running in a local development environment, such as a\ndevelopment workstation, the best option is to use the credentials associated\nwith your [user account](/docs/authentication#user-accounts).\nHow you configure ADC with your user account depends on whether your [user account](/docs/authentication#user-accounts) is managed by Google---in other words, it is a Google Account---or by another identity provider (IdP), and federated by using [Workforce Identity Federation](/iam/docs/workforce-identity-federation).\n\n\u003cbr /\u003e\n\nGoogle Account\n\nTo configure ADC with a Google Account, you use the Google Cloud CLI:\n\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n | **Note:** To add scopes for services outside of Google Cloud, such as Google Drive, [create an OAuth Client ID](https://support.google.com/cloud/answer/6158849) and provide it to the `gcloud auth application-default login` command by using the [`--client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying your scopes with the [`--scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\n\nExternal IdP\n\n\nTo configure ADC for a user account managed by an external IdP and federated\nwith [Workforce Identity Federation](/iam/docs/workforce-identity-federation):\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2.\n\n If you're using a local shell, then create local authentication credentials for your user\n account:\n\n ```bash\n gcloud auth application-default login\n ```\n\n You don't need to do this if you're using Cloud Shell.\n\n\n If an authentication error is returned, and you are using an external identity provider\n (IdP), confirm that you have\n [signed in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n\n A sign-in screen appears. After you sign in, your credentials are stored in the\n [local credential file used by ADC](/docs/authentication/application-default-credentials#personal).\n\n\u003cbr /\u003e\n\nTips for configuring ADC with your user credentials\n\nWhen you configure ADC with your user account, you should be aware of the\nfollowing facts:\n\n- ADC configured with a user account might not work for some APIs without extra\n configuration steps. If you see an error message about the API not being\n enabled in the project, or that there is no quota project available, see\n [User credentials not working](/docs/authentication/troubleshoot-adc#user-creds-client-based).\n\n- The local ADC file contains your refresh token. Any user with access to your\n file system can use it to get a valid access token. If you no longer need\n these local credentials, you can revoke them by using the\n [`gcloud auth application-default revoke` command](/sdk/gcloud/reference/auth/application-default/revoke).\n\n- Your local ADC file is associated with your user account, not your\n gcloud CLI configuration. Changing to a different\n gcloud CLI configuration might change the identity used by the\n gcloud CLI, but it does not affect your local ADC file or the ADC\n configuration.\n\nService account credentials\n\nYou can configure ADC with credentials from a\n[service account](/docs/authentication#service-accounts) by using service account impersonation or by\nusing a service account key.\n\nService account impersonation\n\n\nYou can use service account impersonation to set up a local Application Default\nCredentials (ADC) file. Client libraries that support impersonation\ncan use those credentials automatically. Local ADC files created by using\nimpersonation are supported in the following languages:\n\n- C#\n- Go\n- Java\n- Node.js\n- Python\n\nYou must have the Service Account Token Creator\n(`roles/iam.serviceAccountTokenCreator`) IAM role on the service account you are\nimpersonating. For more information, see\n[Required roles](/docs/authentication/use-service-account-impersonation#required-roles).\n\n\nUse service account impersonation to create a local ADC file: \n\n```\ngcloud auth application-default login --impersonate-service-account SERVICE_ACCT_EMAIL\n```\n\n\nYou can now use client libraries using the supported languages the same way you would after\nsetting up a local ADC file with user credentials. Credentials are automatically found by the\nauthentication libraries. For more information, see\n[Authenticate for using client libraries](/docs/authentication/client-libraries).\n\n\nCredentials from a local ADC file generated by using service account impersonation are not\nsupported by all of the authentication libraries. For more information, see\n[Error returned for local credentials from service account impersonation](/docs/authentication/troubleshoot-adc#local-impersonated).\n\n\u003cbr /\u003e\n\nService account keys\n\nIf you cannot use a user account or service account impersonation for local\ndevelopment, you can use a service account key.\n\n\n| **Note:** Service account keys are a security risk if not managed correctly. You should [choose a more secure alternative to service account keys](/docs/authentication#auth-decision-tree) whenever possible. If you must authenticate with a service account key, you are responsible for the security of the private key and for other operations described by [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys). If you are prevented from creating a service account key, service account key creation might be disabled for your organization. For more information, see [Managing secure-by-default organization resources](/resource-manager/docs/secure-by-default-organizations).\n|\n|\n| If you acquired the service account key from an external source, you must validate it before use.\n| For more information, see [Security requirements for externally sourced credentials](/docs/authentication/external/externally-sourced-credentials).\n\nTo create a service account key and make it available to ADC:\n\n1. Create a service account with the roles your application needs, and a key for that service account, by following the instructions in [Creating a service account key](/iam/docs/keys-create-delete#creating).\n2.\n Set the environment variable `GOOGLE_APPLICATION_CREDENTIALS`\n to the path of the JSON file that contains your credentials.\n This variable applies only to your current shell session, so if you open\n a new session, set the variable again.\n\n **Example:** Linux or macOS \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n export GOOGLE_APPLICATION_CREDENTIALS=\"/home/user/Downloads/service-account-file.json\"\n ```\n **Example:** Windows\n\n For PowerShell: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n\n For example: \n\n ```bash\n $env:GOOGLE_APPLICATION_CREDENTIALS=\"C:\\Users\\username\\Downloads\\service-account-file.json\"\n ```\n\n For command prompt: \n\n set GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eKEY_PATH\u003c/var\u003e with the path of the JSON file that contains your credentials.\n| **Note:** When you set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, ADC checks this location first, then checks other locations only if necessary.\n\n\u003cbr /\u003e\n\nWhat's next\n\n- Understand best practices for using [service account keys](/iam/docs/best-practices-for-managing-service-account-keys).\n\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n\n- [Authenticate for using Cloud Client Libraries](/docs/authentication/client-libraries).\n\n- [Authenticate for using REST](/docs/authentication/rest).\n\n- Explore [authentication methods](/docs/authentication)."]]
