Diagnose: Could not automatically determine credentials

TL;DR

For "google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLEAPPLICATIONCREDENTIALS or": please set GOOGLE\APPLICATION\CREDENTIALS or explicitly create credentials and re-run the application. Confirm, in order: 1. echo $GOOGLE\APPLICATION\CREDENTIALS - if set but the file is gone or invalid, ADC fails here and never checks further. A stale path is the most common cause in CI and containers. Check the instance/service config.

google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application.

When to use

You are seeing this: Symptom: google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Use this skill when you run into "Diagnose: Could not automatically determine credentials".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Steps

1. Symptom: google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application.
2. Cause: ADC checked all three locations and found nothing usable.
3. Confirm, in order:
4. echo $GOOGLE_APPLICATION_CREDENTIALS - if set but the file is gone or invalid, ADC fails here and never checks further. A stale path is the most common cause in CI and containers.
5. gcloud auth application-default print-access-token - fails means no ADC user file. (Note: gcloud auth login does NOT create this file.)
6. On Google Cloud: is there a service account attached to the resource? Check the instance/service config. No attachment means step 3 of the search finds nothing.
7. Fix by environment:

• Local dev: gcloud auth application-default login.
• CI outside Google Cloud: Workload Identity Federation, or set GOOGLEAPPLICATIONCREDENTIALS to a valid key file as a last resort.
• On Google Cloud: attach a service account to the resource instead of shipping credentials.

5. Verify: rerun gcloud auth application-default print-access-token (or your script) and confirm a token is returned. Then run the original failing command.
6. Still failing after a fix? Check that the credential has a quota project if the API bills per caller, and that the identity has IAM on the target resource. Auth working plus 403 means the next diagnosis is IAM, not credentials.

Exact error string is the documented google-auth DefaultCredentialsError. The three-location ADC search order was verified 2026-09-26 on the official ADC docs. The stale-env-var cause is the documented first search location overriding everything else.