Quick Summary
| Aspect | gcloud auth login | gcloud auth application-default login |
|---|---|---|
| Purpose | Authenticates you to use the gcloud CLI itself | Authenticates your code/SDKs to access GCP APIs |
| Credentials stored at | ~/.config/gcloud/credentials.db | ~/.config/gcloud/application_default_credentials.json |
| What picks up credentials | Only gcloud, bq, gsutil CLI commands | Any language SDK (Go, Python, Node.js, Terraform, etc.) |
| Use case | Running CLI commands locally | Local development testing code that will use ADC in production |
Detailed Explanation
gcloud auth login
What it does:
- Authenticates your account for using the gcloud CLI tool
- Stores credentials in
~/.config/gcloud/credentials.db - Allows you to run commands like
gcloud compute instances list
When to use:
# Just running CLI commands
gcloud compute instances list
gcloud app deploy
gcloud kms keys list
Limitation:
- NOT sufficient for tools/libraries relying on Application Default Credentials (ADC)
gcloud auth application-default login
What it does:
- Creates Application Default Credentials (ADC) for your local development
- Stores credentials in
~/.config/gcloud/application_default_credentials.json - Enables any Google Cloud SDK to find credentials automatically
When to use:
1. Go Backend Development
package main
import (
"context"
"cloud.google.com/go/storage"
)
func main() {
ctx := context.Background()
// Automatically finds ADC from application_default_credentials.json
client, err := storage.NewClient(ctx)
// Use client for GCS operations
}
2. Python/Node.js Development
# Python - automatically picks up ADC
from google.cloud import storage
client = storage.Client()
// Node.js - automatically picks up ADC
const {Storage} = require('@google-cloud/storage');
const storage = new Storage();
3. Terraform GCP Provider
provider "google" {
# Automatically uses ADC when running locally
}
Important Notes
Critical Difference
# gcloud auth login alone is NOT sufficient for SDKs
gcloud auth login # For CLI only
gcloud auth application-default login # For SDKs + CLI
Production vs Local Development
| Environment | What to Use |
|---|---|
| Local Development | gcloud auth application-default login |
| GCP Production (VMs, GKE, Cloud Functions) | Service account automatically (no auth needed) |
| External Production (AWS, on-prem) | Service account JSON or Workload Identity Federation |
Quick Command Reference
# Check current authentication status
gcloud auth list
# For CLI-only usage
gcloud auth login
# For SDK + CLI usage (recommended for developers)
gcloud auth application-default login
# Remove application-default credentials
gcloud auth application-default revoke