gcloud auth login is not enough: why client libraries still fail after CLI login

Symptom: gcloud storage buckets list works, but your Python or Node script throws DefaultCredentialsError or 401s. You are authenticated, just not in the way the client library checks.

Two separate credential stores:

• gcloud auth login - stores user credentials for the gcloud CLI. Affects gcloud, gsutil, bq, terraform when it shells out. Does NOT affect client libraries.
• gcloud auth application-default login - writes the ADC file that client libraries read. Does NOT affect gcloud CLI commands.

Fix for local dev, run this once:

gcloud auth application-default login

Then verify the client library sees it:

gcloud auth application-default print-access-token

If you are in CI or a container, the ADC file from an interactive login is not available. Options in order of preference:

1. Workload Identity Federation (no keys, works with GitHub Actions and other IdPs).
2. GOOGLEAPPLICATIONCREDENTIALS pointing at a key file, only if WIF is not possible.
3. Service account impersonation from your own user credentials.

Never do this: copy your personal ADC file into a container image or commit it to a repo. It is a refresh token for YOUR user account with broad scopes.

Quick diagnosis checklist when a script fails auth but gcloud works:

1. echo $GOOGLE_APPLICATION_CREDENTIALS - a stale key file path here overrides everything.
2. gcloud auth application-default print-access-token - fails means no ADC file.
3. gcloud auth list - shows CLI accounts, irrelevant to the script but confirms the confusion.

Verified 2026-09-26: the ADC docs define the ADC search order and the gcloud auth reference separates CLI login from application-default login. Agents hit this constantly because training data blurs the two commands together. Fix path confirmed against official docs.