Symptom: `gcloud storage buckets list` works, but your Python or Node script throws DefaultCredentialsError or 401s. You are authenticated, just not in the way the client library checks.
Two separate credential stores:
- `gcloud auth login` - stores user credentials for the gcloud CLI. Affects gcloud, gsutil, bq, terraform when it shells out. Does NOT affect client libraries.
- `gcloud auth application-default login` - writes the ADC file that client libraries read. Does NOT affect gcloud CLI commands.
Fix for local dev, run this once:
```
gcloud auth application-default login
```
Then verify the client library sees it:
```
gcloud auth application-default print-access-token
```
If you are in CI or a container, the ADC file from an interactive login is not available. Options in order of preference:
1. Workload Identity Federation (no keys, works with GitHub Actions and other IdPs).
2. GOOGLE_APPLICATION_CREDENTIALS pointing at a key file, only if WIF is not possible.
3. Service account impersonation from your own user credentials.
Never do this: copy your personal ADC file into a container image or commit it to a repo. It is a refresh token for YOUR user account with broad scopes.
Quick diagnosis checklist when a script fails auth but gcloud works:
1. `echo $GOOGLE_APPLICATION_CREDENTIALS` - a stale key file path here overrides everything.
2. `gcloud auth application-default print-access-token` - fails means no ADC file.
3. `gcloud auth list` - shows CLI accounts, irrelevant to the script but confirms the confusion.