Registry / gcp / google-auth

google-auth

library2.49.1pypypi✓ verified 44d ago

google-auth is the official Google Authentication Library for Python, providing Application Default Credentials (ADC), service account credentials, OAuth2 tokens, JWT signing/verification, ID token support, Workload Identity Federation, and transport integrations for Requests, urllib3, aiohttp, and gRPC. Current stable version is 2.49.1, released as part of the google-cloud-python monorepo with a roughly monthly cadence.

gcp auth-security

pip install google-auth

github ↗package ↗homepage ↗

Install & Compatibility

Where this runs

tested against v2.53.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.975 runs

installs and imports cleanly · install 0.0s · import 0.052s · 50.6MB

glibc

py 3.10–3.975 runs

installs and imports cleanly · install 4.0s · import 0.048s · 53MB

51MB installed

● package 51MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ from google.auth import default

✗ import google.auth

google.auth

✓ import google.auth

Demonstrates Application Default Credentials (ADC) via google.auth.default() and explicit service account credentials. Set GOOGLE_APPLICATION_CREDENTIALS to a service account JSON key path, or authenticate locally with `gcloud auth application-default login`.

import os import google.auth from google.auth.transport.requests import Request from google.oauth2 import service_account from google.auth.exceptions import DefaultCredentialsError # --- Option 1: Application Default Credentials (recommended for GCP-hosted workloads) # Set GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json, or run: # gcloud auth application-default login os.environ.setdefault('GOOGLE_APPLICATION_CREDENTIALS', os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', '')) try: credentials, project = google.auth.default( scopes=['https://www.googleapis.com/auth/cloud-platform'] ) # Force a token refresh so we can verify auth works credentials.refresh(Request()) print(f'ADC OK — project={project}, token expiry={credentials.expiry}') except DefaultCredentialsError as e: print(f'No credentials found: {e}') # --- Option 2: Explicit service account key file key_path = os.environ.get('GOOGLE_APPLICATION_CREDENTIALS', '') if key_path: sa_creds = service_account.Credentials.from_service_account_file( key_path, scopes=['https://www.googleapis.com/auth/cloud-platform'], ) sa_creds.refresh(Request()) print(f'SA token expiry: {sa_creds.expiry}')

Debug

Known issues

breakingcryptography is now a required (non-optional) dependency as of 2.48.0. The pure-Python rsa package was the previous fallback and has been fully removed in the 2.49.0-dev0 line. Environments that pin rsa or exclude cryptography will break on upgrade.

fix

Ensure cryptography is installed (it is now pulled in automatically). Remove any explicit rsa dependency pins. Do not install the legacy [rsa] extra expecting it to substitute for cryptography.

affects: >=2.48.0

breakingcachetools is no longer a dependency as of 2.47.0. Code that imported or type-annotated against cachetools classes for credential caching will break.

fix

Remove direct cachetools imports from google-auth credential caching logic. The library now uses its own lightweight internal cache.

affects: >=2.47.0

breakingThe pyopenssl and enterprise_cert extras must never be installed together; they require conflicting versions of the cryptography package and will cause runtime errors.

fix

Choose one: pip install google-auth[pyopenssl] OR pip install google-auth[enterprise-cert], never both in the same environment.

affects: >=2.x

gotchagoogle.auth.default() returns a (credentials, project_id) tuple. project_id is None for user credentials (gcloud ADC) and may be None for some external account credentials. Silently passing None as a project to GCP client constructors causes subtle 400/403 errors.

fix

Always check: assert project is not None, or override with GOOGLE_CLOUD_PROJECT env var, or pass project explicitly to the client.

affects: all

gotchaService account credentials returned by google.auth.default() via ADC are not automatically scoped. Calling google.auth.default() without passing scopes= yields credentials that may silently fail when making API calls requiring specific OAuth scopes.

fix

Always pass scopes=['https://www.googleapis.com/auth/cloud-platform'] (or specific scopes) to google.auth.default(). Alternatively call credentials.with_scopes([...]) on the returned object.

affects: all

deprecatedoauth2client (GoogleCredentials.get_application_default()) is fully deprecated and unmaintained. It is not compatible with modern ADC features such as Workload Identity Federation and external account credentials.

fix

Migrate to google-auth: replace oauth2client imports with google.auth.default() or google.oauth2.service_account.Credentials.

affects: all oauth2client versions

gotchaPython 3.7 support was dropped after 2.45.0, and Python 3.8/3.9 are end-of-life and will be dropped in a future release. Pinning google-auth on old Python runtimes may leave you unable to receive security fixes.

fix

Upgrade to Python 3.10+. If stuck on Python 3.7, pin google-auth<=2.45.0.

affects: <2.46.0 for Py3.7; upcoming for Py3.8/3.9

gotchaApplication Default Credentials (ADC) were not found. This typically means the environment variable GOOGLE_APPLICATION_CREDENTIALS is not set, `gcloud auth application-default login` has not been run, or the application is not running on a Google Cloud service with an attached service account.

fix

Ensure ADC are configured: set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or ensure the application runs on a Google Cloud service with an attached service account.

affects: all

gotchaThe library could not find Application Default Credentials (ADC). This means the environment is not configured to provide credentials automatically (e.g., GOOGLE_APPLICATION_CREDENTIALS env var is missing, gcloud auth application-default login has not been run, or it's not running on a Google Cloud platform with a service account attached).

fix

Ensure ADC is configured correctly. Set GOOGLE_APPLICATION_CREDENTIALS to a service account key file, or run gcloud auth application-default login, or ensure the environment (e.g., GCE, Cloud Run, Cloud Functions) has an appropriate service account attached.

affects: all

Upgrade

Version history

2.53.0latest on PyPI

Audit

Dependencies

cryptographyrequiredRequired since 2.48.0 for RSA signing/verification; previously optional, now a hard dependency replacing the deprecated pure-Python rsa package

requestsoptionalRequired for google.auth.transport.requests.Request and AuthorizedSession; install via google-auth[requests]

aiohttpoptionalRequired for google.auth.transport.aiohttp_requests async transport; install via google-auth[aiohttp]

pyOpenSSLoptionalNeeded for mutual TLS (mTLS) via the pyopenssl extra; must NOT be combined with enterprise-cert extra

Agent activity

60 hits · last 30 days

node

seranking-bot

ahrefsbot

Resources

githubhttps://github.com/googleapis/google-auth-library-python ↗

packagehttps://pypi.org/project/google-auth/ ↗

homepagehttps://cloud.google.com/docs/authentication ↗