## TL;DR

For "google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or": please set GOOGLE\_APPLICATION\_CREDENTIALS or explicitly create credentials and re-run the application. Confirm, in order: 1. echo $GOOGLE\_APPLICATION\_CREDENTIALS - if set but the file is gone or invalid, ADC fails here and never checks further. A stale path is the most common cause in CI and containers. Check the instance/service config.

```text
google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application.
```

## When to use

You are seeing this: Symptom: google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Use this skill when you run into "Diagnose: Could not automatically determine credentials".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Steps

1. Symptom: `google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application.`

2. Cause: ADC checked all three locations and found nothing usable.

3. Confirm, in order:
1. `echo $GOOGLE_APPLICATION_CREDENTIALS` - if set but the file is gone or invalid, ADC fails here and never checks further. A stale path is the most common cause in CI and containers.
2. `gcloud auth application-default print-access-token` - fails means no ADC user file. (Note: `gcloud auth login` does NOT create this file.)
3. On Google Cloud: is there a service account attached to the resource? Check the instance/service config. No attachment means step 3 of the search finds nothing.

4. Fix by environment:
- Local dev: `gcloud auth application-default login`.
- CI outside Google Cloud: Workload Identity Federation, or set GOOGLE_APPLICATION_CREDENTIALS to a valid key file as a last resort.
- On Google Cloud: attach a service account to the resource instead of shipping credentials.

5. Verify: rerun `gcloud auth application-default print-access-token` (or your script) and confirm a token is returned. Then run the original failing command.

6. Still failing after a fix? Check that the credential has a quota project if the API bills per caller, and that the identity has IAM on the target resource. Auth working plus 403 means the next diagnosis is IAM, not credentials.