Ardrey 情報マガジン

google credentialsjson

📅 October 29, 2026📖 Verified Publication
```html Google credentials.json Guide: Secure Service Account Auth & Troubleshooting

Google credentials.json: The Complete Guide to Service Account Authentication

If you've ever worked with Google APIs — whether for Sheets, Drive, BigQuery, or Vertex AI — you've likely encountered a file called credentials.json. It's the key that unlocks programmatic access to Google Cloud services, but it's also a frequent source of confusion, permission errors, and security missteps. This guide answers every practical question developers and teams ask about it.

Key Takeaways

  • credentials.json is a service account key issued by Google Cloud IAM — it contains a private key used to authenticate API requests without a human user.
  • Never commit it to version control. Add it to .gitignore and use secret managers or environment variables in production.
  • The "403 Permission Denied" error is almost always a scope or project misconfiguration, not a corrupt file.
  • Rotate keys every 90 days and delete stale ones; each service account can have multiple active keys.
  • Service Account JSON ≠ OAuth consent screen credentials. One is for server-to-server auth, the other for user-facing OAuth flows.

What Is google credentials.json?

credentials.json is the default filename for a Google Cloud Service Account key exported in JSON format. When you create a service account in Google Cloud IAM and generate a key, Google returns a single JSON document containing:

  • type — always "service_account"
  • project_id — the GCP project the account belongs to
  • private_key_id — unique identifier for the key pair
  • private_key — the RSA private key (PEM-encoded)
  • client_email — the @.iam.gserviceaccount.com address used for API auth
  • client_id — numeric client identifier
  • auth_uri / token_uri — Google's OAuth 2.0 endpoints

This file is your programmatic identity. Any application that presents it to Google's authorization servers proves it is that service account — without any user interaction.

credentials.json vs. Other Google Auth Files

File Type Purpose Auth Flow Typical Use Case
credentials.json (Service Account) Server-to-server API access OAuth 2.0 / JWT Bearer Backend services, CI/CD, scripts
client_secret*.json (OAuth Client ID) User-login OAuth flows Authorization Code + Refresh Token Web apps, mobile apps with sign-in
gcloud.json (User Credentials) gcloud CLI authentication Device/OAuth login Developer local workstation
application_default_credentials.json Auto-discovered ADC path Varies by environment Google Cloud Run, GKE, Compute Engine

How to Generate a credentials.json File

Method 1: Google Cloud Console (GUI)

  1. Open the IAM > Service Accounts page.
  2. Select or create a service account.
  3. Click Keys > Add Key > Create new key.
  4. Choose JSON as the key type and click Create.
  5. The browser downloads the file immediately — this is the only time Google shows the private key.

Method 2: gcloud CLI

$ gcloud iam service-accounts keys create credentials.json \
  --iam-account=my-service-account@project.iam.gserviceaccount.com

Method 3: Terraform / IaC

Use the google_service_account_iam_member and google_service_account_key resources. Store the resulting key in a Secret Manager secret rather than writing it to disk directly.

Security Checklist: Protecting Your credentials.json

Before Using credentials.json in Production

  • ☐ Restrict the service account to the minimum required scopes (Principle of Least Privilege).
  • ☐ Add credentials.json to .gitignore before pushing any repository.
  • ☐ Never hard-code the path — pass it via GOGLE_APPLICATION_CREDENTIALS env var or CLI flag.
  • ☐ Enable VPC Service Controls if the project handles sensitive data.
  • ☐ Audit key usage in Cloud Audit Logs for anomalous activity.
  • ☐ Set a key expiration policy and rotate at least every 90 days.
  • ☐ Delete the downloaded copy from your local machine after transferring it to a secret manager.
  • ☐ Use Workload Identity (GKE, Cloud Run) instead of a JSON key whenever possible — it eliminates the file entirely.

Troubleshooting: Common credentials.json Errors

1. "The service account credentials file is not valid JSON"

This usually means the file was corrupted during download or accidentally truncated. Re-download the key from the IAM console. Verify the first line starts with {"type":"service_account" and the last line ends with }.

2. "403 Permission Denied" on API calls

The key is valid, but the service account lacks authorization. Check these three things in order:

  1. IAM roles: Does the service account have the required role (e.g., roles/sheets.editor) on the target resource?
  2. Scopes: If using OAuth libraries, ensure requested scopes match the API you're calling.
  3. Doman-wide delegation: For Google Workspace API access, the