gcloud auth login is not enough: why client libraries still fail after CLI login

TL;DR

Fix for local dev, run this once: ` gcloud auth application-default login Then verify the client library sees it: gcloud auth application-default print-access-token If you are in CI or a container, the ADC file from an interactive login is not available.

Steps

1. Symptom: gcloud storage buckets list works, but your Python or Node script throws DefaultCredentialsError or 401s. You are authenticated, just not in the way the client library checks.
2. Two separate credential stores:

• gcloud auth login - stores user credentials for the gcloud CLI. Affects gcloud, gsutil, bq, terraform when it shells out. Does NOT affect client libraries.
• gcloud auth application-default login - writes the ADC file that client libraries read. Does NOT affect gcloud CLI commands.

3. Fix for local dev, run this once:

gcloud auth application-default login

4. Then verify the client library sees it:

gcloud auth application-default print-access-token

5. If you are in CI or a container, the ADC file from an interactive login is not available. Options in order of preference:
6. Workload Identity Federation (no keys, works with GitHub Actions and other IdPs).
7. GOOGLEAPPLICATIONCREDENTIALS pointing at a key file, only if WIF is not possible.
8. Service account impersonation from your own user credentials.
9. Never do this: copy your personal ADC file into a container image or commit it to a repo. It is a refresh token for YOUR user account with broad scopes.
10. Quick diagnosis checklist when a script fails auth but gcloud works:
11. echo $GOOGLE_APPLICATION_CREDENTIALS - a stale key file path here overrides everything.
12. gcloud auth application-default print-access-token - fails means no ADC file.
13. gcloud auth list - shows CLI accounts, irrelevant to the script but confirms the confusion.

When to use

You are seeing this: Symptom: gcloud storage buckets list works, but your Python or Node script throws DefaultCredentialsError or 401s. Use this skill when you run into "gcloud auth login is not enough: why client libraries still fail after CLI login".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26: the ADC docs define the ADC search order and the gcloud auth reference separates CLI login from application-default login. Agents hit this constantly because training data blurs the two commands together. Fix path confirmed against official docs.