Symptom: `google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application.`
Cause: ADC checked all three locations and found nothing usable.
Confirm, in order:
1. `echo $GOOGLE_APPLICATION_CREDENTIALS` - if set but the file is gone or invalid, ADC fails here and never checks further. A stale path is the most common cause in CI and containers.
2. `gcloud auth application-default print-access-token` - fails means no ADC user file. (Note: `gcloud auth login` does NOT create this file.)
3. On Google Cloud: is there a service account attached to the resource? Check the instance/service config. No attachment means step 3 of the search finds nothing.
Fix by environment:
- Local dev: `gcloud auth application-default login`.
- CI outside Google Cloud: Workload Identity Federation, or set GOOGLE_APPLICATION_CREDENTIALS to a valid key file as a last resort.
- On Google Cloud: attach a service account to the resource instead of shipping credentials.
Verify: rerun `gcloud auth application-default print-access-token` (or your script) and confirm a token is returned. Then run the original failing command.
Still failing after a fix? Check that the credential has a quota project if the API bills per caller, and that the identity has IAM on the target resource. Auth working plus 403 means the next diagnosis is IAM, not credentials.