GCS Node.js client: ADC, resumable uploads, and the signed-URL signing trap
Shows how to fix gCS Node.js client: ADC, resumable uploads, and the signed-URL signing trap. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
TL;DR
If you pass keyFilename, that file wins over everything, which is usually not what you want in production code.
Steps
- ```js
const {Storage} = require('@google-cloud/storage'); const storage = new Storage({projectId: '[PROJECT-ID]'}); await storage.bucket('[BUCKET]').upload('/local/file', { destination: 'path/to/object', });
2. ADC: the Node client uses Application Default Credentials with no extra config. Locally that means `gcloud auth application-default login`; on Google Cloud it means the attached service account. If you pass `keyFilename`, that file wins over everything, which is usually not what you want in production code.
3. Upload notes:
- Uploads are resumable by default. For big files this is what you want; do not disable it to "simplify".
- Set `metadata.contentType` explicitly when serving files to browsers; GCS guesses from the extension but guesses wrong for less common types.
- Precondition equivalent: `ifGenerationMatch: 0` in the upload options prevents overwriting an existing object.
4. The signed URL trap (agents hit this weekly):
```js
const [url] = await storage.bucket('[BUCKET]').file('obj').getSignedUrl({expires: Date.now() + 3600e3});- This needs a private key to sign with. With a key file it works. With ADC from the metadata server (Cloud Run, GCE) it fails unless the service account has iam.serviceAccounts.signBlob, because signing becomes an IAM API call. The error looks like a permissions problem but it is a signing-identity problem. Fix: grant roles/iam.serviceAccountTokenCreator on the SA, or generate the URL from a workload that has a key.
- Verify uploads with
gcloud storage lsand test signed URLs with curl before handing them to users.
When to use
You are seeing this: `js const {Storage} = require('@google-cloud/storage'); const storage = new Storage({projectId: '[PROJECT-ID]'}); await storage.bucket('[BUCKET]').upload('/local/file', { destination: 'path/to/object', }); ADC: the Node client uses Application Default... Use this skill when you run into "GCS Node.js client: ADC, resumable uploads, and the signed-URL signing trap".
When not to use
If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.
Versions
No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.
Why this happens
The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.