Diagnose: Could not automatically determine credentials

Symptom: google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application.

Cause: ADC checked all three locations and found nothing usable.

Confirm, in order:

1. echo $GOOGLE_APPLICATION_CREDENTIALS - if set but the file is gone or invalid, ADC fails here and never checks further. A stale path is the most common cause in CI and containers.
2. gcloud auth application-default print-access-token - fails means no ADC user file. (Note: gcloud auth login does NOT create this file.)
3. On Google Cloud: is there a service account attached to the resource? Check the instance/service config. No attachment means step 3 of the search finds nothing.

Fix by environment:

• Local dev: gcloud auth application-default login.
• CI outside Google Cloud: Workload Identity Federation, or set GOOGLEAPPLICATIONCREDENTIALS to a valid key file as a last resort.
• On Google Cloud: attach a service account to the resource instead of shipping credentials.

Verify: rerun gcloud auth application-default print-access-token (or your script) and confirm a token is returned. Then run the original failing command.

Still failing after a fix? Check that the credential has a quota project if the API bills per caller, and that the identity has IAM on the target resource. Auth working plus 403 means the next diagnosis is IAM, not credentials.

Exact error string is the documented google-auth DefaultCredentialsError. The three-location ADC search order was verified 2026-09-26 on the official ADC docs. The stale-env-var cause is the documented first search location overriding everything else.