{"id":928,"library":"pydata-google-auth","title":"PyData Google Auth","description":"PyData Google Auth is a Python package that provides helper functions for authenticating to Google APIs, simplifying the process of obtaining and caching user and service account credentials. It wraps the underlying `google-auth` and `google-auth-oauthlib` libraries to offer a more convenient interface. The current version is 1.9.1, and the library maintains an active release cadence with frequent minor and patch updates.","status":"active","version":"1.9.1","language":"python","source_language":"en","source_url":"https://github.com/pydata/pydata-google-auth","tags":["google","auth","authentication","pydata","credentials","oauth","gcp"],"install":[{"cmd":"pip install pydata-google-auth","lang":"bash","label":"Install latest version"}],"dependencies":[{"reason":"Required for package installation.","package":"setuptools","optional":false},{"reason":"Core library for Google authentication and authorization.","package":"google-auth","optional":false},{"reason":"Integration with oauthlib for end-user authentication.","package":"google-auth-oauthlib","optional":false},{"reason":"Deprecated in 1.9.0; no longer required on Python 3.","package":"six","optional":true}],"imports":[{"note":"Used for authenticating with user accounts via OAuth 2.0 flow.","symbol":"get_user_credentials","correct":"from pydata_google_auth import get_user_credentials"},{"note":"Used for authenticating with service accounts using a JSON key file.","symbol":"load_service_account_credentials","correct":"from pydata_google_auth import load_service_account_credentials"},{"note":"Attempts to get Application Default Credentials and falls back to user credentials if not found.","symbol":"default","correct":"from pydata_google_auth import default"}],"quickstart":{"code":"import os\nfrom pydata_google_auth import get_user_credentials\nfrom google.cloud import bigquery\n\n# Define the necessary scopes for BigQuery access\nSCOPES = [\n    'https://www.googleapis.com/auth/cloud-platform',\n    'https://www.googleapis.com/auth/bigquery'\n]\n\n# Get user credentials (will open a browser for OAuth flow if not cached)\n# `use_local_webserver=True` is the default and recommended for desktop apps.\ncredentials = get_user_credentials(SCOPES)\n\n# Use an environment variable for project_id or replace with your actual ID\nproject_id = os.environ.get('GCP_PROJECT_ID', 'your-gcp-project-id')\n\n# Initialize a Google Cloud BigQuery client with the obtained credentials\nclient = bigquery.Client(project=project_id, credentials=credentials)\n\nprint(f\"Authenticated successfully to project: {client.project}.\")\nprint(\"You can now use 'client' to interact with BigQuery.\")\n\n# Example: List datasets (requires appropriate permissions for the scopes)\ntry:\n    datasets = list(client.list_datasets())\n    if datasets:\n        print(f\"Found {len(datasets)} datasets.\")\n    else:\n        print(\"No datasets found in the project.\")\nexcept Exception as e:\n    print(f\"Error listing datasets: {e}\")","lang":"python","description":"This quickstart demonstrates how to obtain user credentials using `get_user_credentials` and then use them to initialize a Google Cloud BigQuery client. The process will typically open a browser window for you to authenticate via Google's OAuth 2.0 flow if credentials are not already cached."},"warnings":[{"fix":"Ensure your environment allows for a local web server (ports 8080-8089 by default) for the OAuth callback, or explicitly set `use_local_webserver=False` and be prepared for the console-based flow, which may eventually cease to function. The `auth_local_webserver` parameter is also deprecated; use `use_local_webserver` instead.","message":"The default behavior of `get_user_credentials` for `use_local_webserver` changed from `False` to `True` in version 1.4.0. This was due to Google's deprecation of the \"out of band\" (copy-paste token) OAuth flow. If you were explicitly setting `use_local_webserver=False` and relying on the console-based flow, this might break your application if you update without adjustment.","severity":"breaking","affected_versions":">=1.4.0"},{"fix":"Upgrade your Python environment to 3.9 or newer. Python 3.13 is now officially supported.","message":"Version 1.9.0 dropped support for Python versions older than 3.9. Projects on Python 3.8 or earlier will need to upgrade their Python interpreter to use this version or newer.","severity":"breaking","affected_versions":">=1.9.0"},{"fix":"Obtain your own OAuth 2.0 Client ID and secret from the Google Cloud Console and pass them to the `client_id` and `client_secret` parameters of `get_user_credentials`.","message":"When developing a tool or library, you should provide your own `client_id` and `client_secret` when calling `get_user_credentials` to prevent masking your API client's identity, as per Google APIs terms of service.","severity":"gotcha","affected_versions":"All"},{"fix":"Store the service account key in a secure location and reference its path via an environment variable (e.g., `GOOGLE_APPLICATION_CREDENTIALS`) or load it from a secure secret manager. Avoid hardcoding paths or embedding keys directly in code.","message":"For service account credentials, the JSON key file contains sensitive information. It is critical to manage this file securely, never commit it to source control, and use environment variables or secure storage mechanisms in production environments.","severity":"gotcha","affected_versions":"All"},{"fix":"To prevent credentials from being written to disk, pass `credentials_cache=pydata_google_auth.cache.NOOP` to `get_user_credentials` or `default`.","message":"By default, `pydata-google-auth` caches user credentials on disk in `$HOME/.config/pydata/pydata_google_credentials.json` (or `$APPDATA` on Windows). On shared computing resources like Google Colab or GCE VMs, writing credentials to disk may be undesirable or insecure.","severity":"gotcha","affected_versions":"All"},{"fix":"Install the specific `google.cloud` package you intend to use (e.g., `pip install google-cloud-bigquery`).","message":"The `google.cloud` modules (e.g., `google.cloud.bigquery`) are not direct dependencies of `pydata-google-auth` and must be installed separately if you intend to use them. For example, to use BigQuery, you need to install `google-cloud-bigquery`.","severity":"gotcha","affected_versions":"All"},{"fix":"Install the required Google Cloud client libraries (e.g., `pip install google-cloud-bigquery`) into your environment.","message":"When using `pydata-google-auth` in conjunction with Google Cloud client libraries (e.g., `google-cloud-bigquery`, `google-cloud-storage`), ensure those client libraries are explicitly installed. `pydata-google-auth` provides authentication helpers but does not automatically install other `google-cloud` packages.","severity":"gotcha","affected_versions":"All"}],"env_vars":null,"search_vec":"'1.9.1':55 'account':30 'activ':61 'api':19 'auth':3,6,38,42,71 'authent':16,72 'cach':26 'cadenc':63 'conveni':49 'credenti':31,74 'current':52 'frequent':65 'function':14 'gcp':76 'googl':2,5,18,37,41,70 'google-auth':36 'google-auth-oauthlib':40 'helper':13 'interfac':50 'librari':44,58 'maintain':59 'minor':66 'oauth':75 'oauthlib':43 'obtain':24 'offer':46 'packag':10 'patch':68 'process':22 'provid':12 'pydata':1,4,73 'python':9 'releas':62 'servic':29 'simplifi':20 'under':35 'updat':69 'user':27 'version':53 'wrap':33","created_at":"2026-03-29T06:08:05.786108+00:00","updated_at":"2026-04-16T18:24:33.244586+00:00","problems":[{"fix":"Install the package using pip: `pip install pydata-google-auth` or conda: `conda install pydata-google-auth --channel conda-forge`.","cause":"The `pydata-google-auth` package is not installed in the Python environment where the code is being executed, or the environment lacks access to the installed package.","error":"ModuleNotFoundError: No module named 'pydata_google_auth'"},{"fix":"Set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of your service account key file (e.g., `export GOOGLE_APPLICATION_CREDENTIALS=\"/path/to/key.json\"`), or run `gcloud auth application-default login` to set up user application default credentials locally.","cause":"The application is attempting to use Google Application Default Credentials (ADC) but cannot find them in the expected locations, such as the `GOOGLE_APPLICATION_CREDENTIALS` environment variable, a service account key file, or the Google Cloud metadata service (for GCE, Cloud Run, etc.).","error":"google.auth.exceptions.DefaultCredentialsError: Could not automatically determine credentials."},{"fix":"Ensure that a `client_secrets.json` file is correctly configured and accessible if using `get_user_credentials`, or that the environment variables for Application Default Credentials are set. Verify that the necessary API scopes are correctly provided and enabled for your Google Cloud project.","cause":"The `pydata-google-auth` library tried multiple methods (e.g., Application Default Credentials, cached user credentials, OAuth 2.0 flow) to obtain valid credentials but failed to retrieve any that were usable for the requested scopes.","error":"pydata_google_auth.exceptions.PyDataCredentialsError: Could not get any valid credentials."},{"fix":"Ensure that when obtaining or loading user credentials, all necessary fields including `refresh_token`, `token_uri`, `client_id`, and `client_secret` are present in the `google.oauth2.credentials.Credentials` object. Re-run the full OAuth 2.0 authorization flow to acquire a complete set of credentials including a refresh token if these fields are missing.","cause":"The loaded credentials object is missing one or more required fields (e.g., `refresh_token`, `token_uri`, `client_id`, `client_secret`) that are essential for refreshing an expired access token, often occurring with manually constructed or incomplete credential objects.","error":"google.auth.exceptions.RefreshError: The credentials do not contain the necessary fields need to refresh the access token. You must specify refresh_token, token_uri, client_id, and client_secret."},{"fix":"Check your internet connection, verify proxy settings if applicable, inspect firewall rules to ensure outbound connections to Google's authentication endpoints (e.g., `accounts.google.com`) are allowed, and consider implementing retry logic for transient network failures.","cause":"A network-related issue, such as a firewall, proxy configuration, transient network problem, or an unresponsive server, prevented the HTTP request to Google's authentication or API servers from completing.","error":"requests.exceptions.ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))"}],"ecosystem":"pypi","meta_description":null,"install_score":100,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"1.9.1","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/pydata/pydata-google-auth","docs":null,"changelog":null,"pypi":"https://pypi.org/project/pydata-google-auth/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["gcp","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-28","last_verified":"2026-08-27","next_check":"2026-07-28","install_tag":"verified"}}