Key Takeaways

• credentials.json is a service account key file that authenticates applications to Google Cloud Platform APIs. It contains a private key in JSON format and is the primary method for non-interactive programmatic access.
• It is the most common but least secure authentication method for GCP workloads. Google itself recommends metadata-based authentication (Workload Identity, application default credentials) over key files wherever possible.
• Rotating credentials every 90 days and storing them in secret managers (Cloud Secret Manager, HashiCorp Vault) is critical to minimizing breach exposure.
• Application Default Credentials (ADC) automatically resolve the appropriate authentication method — making explicit credentials.json usage unnecessary in many modern GCP environments.
• Leaked credentials.json files are a leading cause of cloud supply-chain attacks. Over 40% of publicly exposed cloud secrets found on GitHub in 2024 were GCP service account keys.

What Is credentials.json in Google Cloud Platform?

A credentials.json file — formally called a service account key — is a machine-readable JSON document issued by Google Cloud IAM that grants cryptographic proof of identity for a service account. When your application presents this file during an API call, Google's authorization servers validate the embedded digital signature and issue an access token on your behalf.

The file typically looks like this:

{
  "type": "service_account",
  "project_id": "my-project-12345",
  "private_key_id": "a1b2c3d4e5f6...",
  "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA...",
  "client_email": "my-sa@my-project.iam.gserviceaccount.com",
  "client_id": "112233445566...",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/..."
}

Each field serves a specific role in the OAuth 2.0 / OIDC authentication flow. The private_key is signed with the RSA-256 algorithm, and Google uses the corresponding public certificate (served at auth_provider_x509_cert_url) to verify authenticity — meaning the private key never leaves the file, only the signed assertion does.

How credentials.json Authenticated Requests Work

1. The SDK or library loads the credentials.json file from disk.
2. It constructs a JSON Web Token (JWT) signed with the embedded private key.
3. The JWT is exchanged at the token_uri endpoint for a short-lived OAuth 2.0 access token (valid for 1 hour).
4. The access token is attached to subsequent API requests in the Authorization: Bearer header.
5. If the token expires, the cycle repeats automatically via library-level refresh logic.

This flow is defined by the Google Cloud Authentication documentation and is implemented transparently by client libraries across Python, Go, Java, Node.js, and other languages.

Where to Find and Manage Your credentials.json

Creating a New Key via Google Cloud Console

1. Navigate to IAM & Admin > Service Accounts in the GCP Console.
2. Select or create the target service account.
3. Click Keys > Add key > Create new key.
4. Choose JSON as the key type and click Create.
5. Download the file immediately — it is shown only once.

Creating a Key via gcloud CLI

gcloud iam service-accounts keys create credentials.json \
  --iam-account=my-sa@my-project.iam.gserviceaccount.com

Creating a Key via Terraform

resource "google_service_account_key" "default" {
  service_account_id = google_service_account.default.name
  public_key_type    = "TYPE_X509_PKCS8"
}

Note: Terraform-managed keys appear in the GCP Console but are tracked in state. Deleting the Terraform resource will rotate (not delete) the key — you must explicitly manage key lifecycle.

Advantages of Using credentials.json

Universal Compatibility

The credentials.json file works with every Google Cloud client library and any third-party tool that supports the GOOGLE_APPLICATION_CREDENTIALS environment variable. It is the default authentication path for CI/CD pipelines, local development, Kubernetes pods running on Compute Engine, and hybrid on-premises deployments where Workload Identity is unavailable.

Explicit and Predictable

Unlike Application Default Credentials (ADC), which search multiple locations in a defined order, a credentials.json file provides a single, unambiguous identity source. This predictability is valuable in debug scenarios and when reproducing production behavior locally.

Fine-Grained IAM Binding

Each service account key is tied to a specific IAM role set. You can create distinct keys for distinct purposes — a build key with only Cloud Build access, a deployment key with Cloud Deploy permissions — and revoke one without affecting the others. This supports the principle of least privilege when keys are managed correctly.

Works in Air-Gapped and Edge Environments

In environments without access to the GCP metadata server (edge computing, on-prem data centers, Kubernetes clusters outside GKE), credentials.json is the only practical keyless-authentication alternative. It requires no network calls to an internal metadata endpoint, only the standard OAuth token exchange over the public internet.

Offline and Batch Processing

For batch jobs, Dataflow pipelines, and offline ML training where a persistent metadata endpoint may not be available, embedding or mounting a credentials.json file is the standard operational pattern recommended in the Google Cloud Dataflow documentation.

Drawbacks and Security Risks of credentials.json

Single Point of Failure

Once compromised, a credentials.json file grants the attacker full access to every resource the associated service account can reach. Unlike a stolen password that can be reset quickly, revoking a service account key