gcloud CLI を使用して API を呼び出す場合は、gcloud CLI 構成で割り当てプロジェクトを設定できます。
gcloud config set billing/quota_project YOUR_PROJECT
REST または RPC API を直接呼び出す場合は、x-goog-user-project HTTP ヘッダーを使用して各リクエストで割り当てプロジェクトを指定する。詳細については、REST リクエストを使用して割り当てプロジェクトを設定するをご覧ください。
プロジェクトを請求先プロジェクトとして指定するには、serviceusage.services.use IAM 権限が必要です。serviceusage.services.use 権限は、Service Usage ユーザーの IAM ロールに含まれています。プロジェクトに対する serviceusage.services.use 権限がない場合は、セキュリティ管理者か、プロジェクトの Service Usage ユーザーのロールを付与できるプロジェクト オーナーに連絡します。
リクエスト対象のプリンシパルに必要な IAM ロールがあることを確認します。ユーザー認証情報を使用している場合は、ユーザー アカウントに関連付けられているメールアドレスにロールを付与する必要があります。サービス アカウントを使用している場合は、そのサービス アカウントに必要なロールが必要です。
API リクエストで API キーを指定すると、任意の場所の ADC よりも API キーが優先されます。GOOGLE_APPLICATION_CREDENTIALS 環境変数を設定して、API キーを使用している場合、ADC に指定した認証情報が無視されていることを示す警告が API から返されることがあります。警告を停止するには、GOOGLE_APPLICATION_CREDENTIALS 環境変数の設定を解除します。
認識されない認証情報のタイプ
API リクエストで Error creating credential
from JSON. Unrecognized credential type を含むエラーが返された場合は、有効な認証情報を使用していることを確認してください。クライアント ID ファイルでは、ADC の認証情報を提供できません。
サービス アカウントの権限借用からローカル認証情報に対してエラーが返される
サービス アカウントの権限借用を使用して生成されたローカル ADC ファイルの認証情報は、すべての認証ライブラリでサポートされているわけではありません。呼び出しが Neither metadata server or valid service
account credentials are found のようなエラーを返した場合、このタスクにローカルの権限借用済み認証情報は使用できません。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eThis page covers common issues encountered when using Application Default Credentials (ADC), including problems with user credentials, incorrect credentials, unrecognized credential types, errors with service account impersonation, quota project issues, and access blocked by scopes.\u003c/p\u003e\n"],["\u003cp\u003eWhen using client-based APIs with user credentials, a quota project must be specified for billing and quota purposes; this can be set through the ADC file, the gcloud CLI config, or the \u003ccode\u003ex-goog-user-project\u003c/code\u003e HTTP header.\u003c/p\u003e\n"],["\u003cp\u003eIf user credentials are not working, ensure that the API is enabled in the specified project, and that the user has the \u003ccode\u003eserviceusage.services.use\u003c/code\u003e IAM permission or the Service Usage Consumer role.\u003c/p\u003e\n"],["\u003cp\u003eWhen troubleshooting credential access problems, confirm that the correct credentials are being used, the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable is set appropriately, the requesting principal has the required IAM roles, and that an API key isn't overriding ADC.\u003c/p\u003e\n"],["\u003cp\u003eIf you receive an "Access blocked" error when creating a local ADC file, check if you're using scopes unsupported by the default ADC setup, and if necessary, use an OAuth Client ID to add scopes for non-Google Cloud services.\u003c/p\u003e\n"]]],[],null,["This page describes some common problems you might encounter when using\nApplication Default Credentials (ADC).\n\nFor information about how ADC works, including where credentials are found, see\n[How Application Default Credentials works](/docs/authentication/application-default-credentials).\n\nUser credentials not working\n\nIf your API request returns an error message about user credentials not being\nsupported by this API, the API not being enabled in the project, or no quota\nproject being set, review the following information.\n\nThere are two kinds of Google Cloud APIs:\n\n- *Resource-based APIs*, which use the project associated with the resources\n being accessed for billing and quota.\n\n- *Client-based APIs*, which use the project associated with the client\n accessing the resources for billing and quota.\n\nWhen you provide user credentials to authenticate to a client-based API, you\nmust specify the project to use for billing and quota. This project is called\nthe *quota project*.\n\nThere are a number of ways to specify a quota project, including the following\noptions:\n\n- Update your ADC file to use a different project as the quota project:\n\n ```\n gcloud auth application-default set-quota-project YOUR_PROJECT\n ```\n- If you are using the gcloud CLI to call the API, you can set\n your quota project in your gcloud CLI config:\n\n ```\n gcloud config set billing/quota_project YOUR_PROJECT\n ```\n- If you are calling the REST or RPC API directly, use the\n `x-goog-user-project` HTTP header to specify a quota project in each\n request. For details, see\n [Set the quota project with a REST request](/docs/authentication/rest#set-billing-project).\n\n| **Note:** The API you are trying to use must be enabled in whatever project you specify.\n\n\nYou must have the `serviceusage.services.use` IAM permission for\na project to be able to designate it as your billing project. The\n`serviceusage.services.use` permission is included in the Service Usage Consumer\nIAM role. If you don't have the `serviceusage.services.use`\npermission for any project, contact your security administrator or a project\nowner who can give you the Service Usage Consumer role in the project.\n\nFor more information about quota projects, see\n[Quota project overview](/docs/quotas/quota-project). For information about additional ways\nto set the quota project, see [Set the quota project](/docs/quotas/set-quota-project).\n\nIncorrect credentials\n\nIf your credentials don't seem to be providing the access you expect, or aren't\nfound, check the following:\n\n- If you are using the gcloud CLI to access Google Cloud in a\n local environment, make sure you understand which credentials you are using.\n When you use the gcloud CLI, you are using the credentials you\n provided to the gcloud CLI by using the `gcloud auth login`\n command. You are not using the credentials you provided to ADC. For more\n information about these two sets of credentials, see\n [gcloud CLI authentication configuration and ADC configuration](/docs/authentication/gcloud#gcloud-credentials).\n\n- Make sure that the `GOOGLE_APPLICATION_CREDENTIALS` environment variable is\n set *only* if you are using a service account key or other JSON file for ADC.\n The credentials pointed to by the environment variable take precedence over\n other credentials, including for Workload Identity Federation for GKE.\n\n- Confirm that the principal making the request has the required\n IAM roles. If you are using user credentials, then the roles\n must be granted to the email address associated with the user account. If\n you are using a service account, then that service account must have the\n required roles.\n\n- If you provide an API key with the API request, the API key takes precedence\n over ADC in any location. If you have set the `GOOGLE_APPLICATION_CREDENTIALS`\n environment variable and you are using an API key, the API might return a\n warning telling you that the credentials you provided to ADC are being\n ignored. To stop the warning, unset the `GOOGLE_APPLICATION_CREDENTIALS`\n environment variable.\n\nUnrecognized credential type\n\nIf your API request returns an error that includes `Error creating credential\nfrom JSON. Unrecognized credential type`, make sure you are using a valid\ncredential. Client ID files are not supported to provide credentials for ADC.\n\nError returned for local credentials from service account impersonation\n\nCredentials from a local ADC file generated by using service account\nimpersonation are not supported by all of the authentication libraries. If your\ncall returns an error similar to `Neither metadata server or valid service\naccount credentials are found`, you can't use local impersonated credentials for\nthis task.\n\nTo avoid this error, create your ADC file from your user credentials or run your\ncode in an environment that has a metadata server available (such as\nCompute Engine).\n\nUnknown project `764086051850` used for request\n\nProject `764086051850` is the project used by the gcloud CLI. If you\nsee authentication errors referencing this project, you are trying to use\na client-based API and you have not set both your project and your quota\nproject for your configuration.\n\nFor more information, see [User credentials not working](#user-creds-client-based).\n\nAccess blocked when using scopes\n\nWhen you attempt to create a local ADC file, and an error similar to `This app\nis blocked` or `Access blocked: Authorization Error` is returned, you might be\nattempting to use scopes that aren't supported by the\n[default ADC setup command](/docs/authentication/set-up-adc-local-dev-environment#google-idp). Typically, this issue is caused by\nadding scopes for applications outside of Google Cloud, such as Google\nDrive.\n\n\nBy default, the access tokens generated from a local ADC file created with user credentials include\nthe [cloud-wide scope `https://www.googleapis.com/auth/cloud-platform`](/docs/authentication#authorization-gcp).\nTo specify scopes explicitly, you use the\n[`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)\nwith the `gcloud auth application-default login` command.\n\n\nTo add scopes for services outside of Google Cloud, such as Google Drive,\n[create an OAuth Client ID](https://support.google.com/cloud/answer/6158849)\nand provide it to the `gcloud auth application-default login` command by using the\n[`---client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying\nyour scopes with the [`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)."]]
