{"id":273,"library":"google-auth","title":"Google Auth","description":"google-auth is the official Google Authentication Library for Python, providing Application Default Credentials (ADC), service account credentials, OAuth2 tokens, JWT signing/verification, ID token support, Workload Identity Federation, and transport integrations for Requests, urllib3, aiohttp, and gRPC. Current stable version is 2.49.1, released as part of the google-cloud-python monorepo with a roughly monthly cadence.","status":"active","version":"2.49.1","language":"python","source_language":"en","source_url":"https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth","tags":["google","authentication","oauth2","credentials","adc","service-account","jwt","gcp","workload-identity"],"install":[{"cmd":"pip install google-auth","lang":"bash","label":"Core (no transport)"},{"cmd":"pip install google-auth[requests]","lang":"bash","label":"With requests transport"},{"cmd":"pip install google-auth[aiohttp]","lang":"bash","label":"With async aiohttp transport"}],"dependencies":[{"reason":"Required since 2.48.0 for RSA signing/verification; previously optional, now a hard dependency replacing the deprecated pure-Python rsa package","package":"cryptography","optional":false},{"reason":"Required for google.auth.transport.requests.Request and AuthorizedSession; install via google-auth[requests]","package":"requests","optional":true},{"reason":"Required for google.auth.transport.aiohttp_requests async transport; install via google-auth[aiohttp]","package":"aiohttp","optional":true},{"reason":"Needed for mutual TLS (mTLS) via the pyopenssl extra; must NOT be combined with enterprise-cert extra","package":"pyOpenSSL","optional":true}],"imports":[{"wrong":"import google.auth","symbol":"default","correct":"from google.auth import default"},{"wrong":null,"symbol":"google.auth","correct":"import google.auth"}],"quickstart":{"code":"import os\nimport google.auth\nfrom google.auth.transport.requests import Request\nfrom google.oauth2 import service_account\nfrom google.auth.exceptions import DefaultCredentialsError\n\n# --- Option 1: Application Default Credentials (recommended for GCP-hosted workloads)\n# Set GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json, or run:\n#   gcloud auth application-default login\nos.environ.setdefault('GOOGLE_APPLICATION_CREDENTIALS', os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', ''))\n\ntry:\n    credentials, project = google.auth.default(\n        scopes=['https://www.googleapis.com/auth/cloud-platform']\n    )\n    # Force a token refresh so we can verify auth works\n    credentials.refresh(Request())\n    print(f'ADC OK — project={project}, token expiry={credentials.expiry}')\nexcept DefaultCredentialsError as e:\n    print(f'No credentials found: {e}')\n\n# --- Option 2: Explicit service account key file\nkey_path = os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', '')\nif key_path:\n    sa_creds = service_account.Credentials.from_service_account_file(\n        key_path,\n        scopes=['https://www.googleapis.com/auth/cloud-platform'],\n    )\n    sa_creds.refresh(Request())\n    print(f'SA token expiry: {sa_creds.expiry}')\n","lang":"python","description":"Demonstrates Application Default Credentials (ADC) via google.auth.default() and explicit service account credentials. Set GOOGLE_APPLICATION_CREDENTIALS to a service account JSON key path, or authenticate locally with `gcloud auth application-default login`."},"warnings":[{"fix":"Ensure cryptography is installed (it is now pulled in automatically). Remove any explicit rsa dependency pins. Do not install the legacy [rsa] extra expecting it to substitute for cryptography.","message":"cryptography is now a required (non-optional) dependency as of 2.48.0. The pure-Python rsa package was the previous fallback and has been fully removed in the 2.49.0-dev0 line. Environments that pin rsa or exclude cryptography will break on upgrade.","severity":"breaking","affected_versions":">=2.48.0"},{"fix":"Remove direct cachetools imports from google-auth credential caching logic. The library now uses its own lightweight internal cache.","message":"cachetools is no longer a dependency as of 2.47.0. Code that imported or type-annotated against cachetools classes for credential caching will break.","severity":"breaking","affected_versions":">=2.47.0"},{"fix":"Choose one: pip install google-auth[pyopenssl] OR pip install google-auth[enterprise-cert], never both in the same environment.","message":"The pyopenssl and enterprise_cert extras must never be installed together; they require conflicting versions of the cryptography package and will cause runtime errors.","severity":"breaking","affected_versions":">=2.x"},{"fix":"Always check: assert project is not None, or override with GOOGLE_CLOUD_PROJECT env var, or pass project explicitly to the client.","message":"google.auth.default() returns a (credentials, project_id) tuple. project_id is None for user credentials (gcloud ADC) and may be None for some external account credentials. Silently passing None as a project to GCP client constructors causes subtle 400/403 errors.","severity":"gotcha","affected_versions":"all"},{"fix":"Always pass scopes=['https://www.googleapis.com/auth/cloud-platform'] (or specific scopes) to google.auth.default(). Alternatively call credentials.with_scopes([...]) on the returned object.","message":"Service account credentials returned by google.auth.default() via ADC are not automatically scoped. Calling google.auth.default() without passing scopes= yields credentials that may silently fail when making API calls requiring specific OAuth scopes.","severity":"gotcha","affected_versions":"all"},{"fix":"Migrate to google-auth: replace oauth2client imports with google.auth.default() or google.oauth2.service_account.Credentials.","message":"oauth2client (GoogleCredentials.get_application_default()) is fully deprecated and unmaintained. It is not compatible with modern ADC features such as Workload Identity Federation and external account credentials.","severity":"deprecated","affected_versions":"all oauth2client versions"},{"fix":"Upgrade to Python 3.10+. If stuck on Python 3.7, pin google-auth<=2.45.0.","message":"Python 3.7 support was dropped after 2.45.0, and Python 3.8/3.9 are end-of-life and will be dropped in a future release. Pinning google-auth on old Python runtimes may leave you unable to receive security fixes.","severity":"gotcha","affected_versions":"<2.46.0 for Py3.7; upcoming for Py3.8/3.9"},{"fix":"Ensure ADC are configured: set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or ensure the application runs on a Google Cloud service with an attached service account.","message":"Application Default Credentials (ADC) were not found. This typically means the environment variable GOOGLE_APPLICATION_CREDENTIALS is not set, `gcloud auth application-default login` has not been run, or the application is not running on a Google Cloud service with an attached service account.","severity":"gotcha","affected_versions":"all"},{"fix":"Ensure ADC is configured correctly. Set GOOGLE_APPLICATION_CREDENTIALS to a service account key file, or run gcloud auth application-default login, or ensure the environment (e.g., GCE, Cloud Run, Cloud Functions) has an appropriate service account attached.","message":"The library could not find Application Default Credentials (ADC). This means the environment is not configured to provide credentials automatically (e.g., GOOGLE_APPLICATION_CREDENTIALS env var is missing, gcloud auth application-default login has not been run, or it's not running on a Google Cloud platform with a service account attached).","severity":"gotcha","affected_versions":"all"}],"env_vars":null,"search_vec":"'2.49.1':45 'account':20,68 'adc':18,65 'aiohttp':38 'applic':15 'auth':2,5 'authent':10,62 'cadenc':60 'cloud':53 'credenti':17,21,64 'current':41 'default':16 'feder':31 'gcp':70 'googl':1,4,9,52,61 'google-auth':3 'google-cloud-python':51 'grpc':40 'id':26 'ident':30,73 'integr':34 'jwt':24,69 'librari':11 'monorepo':55 'month':59 'oauth2':22,63 'offici':8 'part':48 'provid':14 'python':13,54 'releas':46 'request':36 'rough':58 'servic':19,67 'service-account':66 'signing/verification':25 'stabl':42 'support':28 'token':23,27 'transport':33 'urllib3':37 'version':43 'workload':29,72 'workload-ident':71","created_at":"2026-03-28T05:38:11.868627+00:00","updated_at":"2026-04-16T15:18:48.536203+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":100,"quickstart_score":0,"quickstart_tag":"stale","pypi_latest":"2.57.0","cli_name":"","cli_version":null,"type":"library","homepage":"https://cloud.google.com/docs/authentication","github":"https://github.com/googleapis/google-auth-library-python","docs":null,"changelog":null,"pypi":"https://pypi.org/project/google-auth/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["gcp","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-08-27","next_check":"2026-08-02","install_tag":"verified"}}