Google credentials.json: The Complete Guide to Service Account Authentication

What Is a Google credentials.json File?

A credentials.json file is the exported service account key generated by Google Cloud Platform (GCP). It stores the cryptographic identity of a service account in JSON format, containing fields that allow an application to prove its identity to Google's authorization servers.

What Does the File Contain?

When you download a JSON key from the Google Cloud Console, the resulting file includes the following core fields:

How to Generate a Google credentials.json File

Follow these steps to create a new service account key from the Google Cloud Console:

1. Open the Google Cloud Console (console.cloud.google.com) and select your project.
2. Navigate to IAM & Admin > Service Accounts.
3. Click + Create Service Account, assign a name and description, then click Finish.
4. Select the roles the service account needs (e.g., Storage Object Admin, BigQuery Data Editor). Assign only the minimum required permissions.
5. Click + Create Key, choose JSON as the key type, and click Create.
6. The credentials.json file downloads automatically. Store it securely.

Generate via gcloud CLI (Alternative Method)

If you prefer the command line, run the following:

gcloud iam service-accounts create my-service-account \
  --display-name="My Service Account"

gcloud iam service-accounts keys create credentials.json \
  --iam-account=my-service-account@your-project.iam.gserviceaccount.com

How to Use credentials.json in Your Application

Once you have the credentials.json file, your application can load it to authenticate against Google APIs. Below are the most common implementation patterns.

Python (Google Auth Library)

from google.oauth2 import service_account
from googleapiclient.discovery import build

credentials = service_account.Credentials.from_service_account_file(
    'credentials.json',
    scopes=['https://www.googleapis.com/auth/spreadsheets.readonly']
)

service = build('sheets', 'v4', credentials=credentials)

Node.js (google-auth-library)

const {GoogleAuth} = require('google-auth-library');

const auth = new GoogleAuth({
  keyFile: 'credentials.json',
  scopes: ['https://www.googleapis.com/auth/cloud-platform'],
});

const client = await auth.getClient();
const accessToken = await client.getAccessToken();

Java (Google Auth Library for Java)

GoogleCredentials credentials = GoogleCredentials
    .fromStream(new FileInputStream("credentials.json"))
    .createScoped(Arrays.asList(
        "https://www.googleapis.com/auth/bigquery"
    ));

Common Problems and How to Solve Them

Problem 1: "InvalidGrant" or "Unauthorized" Errors

If your requests return 401 Unauthorized or invalid_grant, check the following:

• Verify the scopes you're requesting match the API permissions the service account actually has.
• Ensure the service account has been granted the correct roles in IAM > Members.
• Confirm the credentials.json file has not been rotated or deleted in the Cloud Console.
• Check that the project ID inside the JSON matches the project where the APIs are enabled.

Problem 2: Permission Denied Even With Correct Credentials

Service account keys authenticate identity — they do not automatically grant access. If you receive 403 Permission denied:

• Assign the appropriate IAM role to the service account in the target project.
• For Google Workspace domains, enable domain-wide delegation and grant the service account the required OAuth scopes.
• Make sure the target API is enabled in APIs & Services > Library.

Problem 3: "File Not Found" When Loading credentials.json

Applications often fail to locate the JSON file because the relative path is incorrect. Always resolve the absolute path at runtime:

import os
from google.oauth2 import service_account

base_path = os.path.dirname(os.path.abspath(__file__))
key_path = os.path.join(base_path, 'credentials.json')

credentials = service_account.Credentials.from_service_account_file(
    key_path, scopes=['https://www.googleapis.com/auth/bigquery']
)

Security Checklist for Google credentials.json