Cannot use default service account in Compute Engine

I’m trying to figure out how I can use the service account associated with a Compute Engine without the need of a JSON file. I cant seem to be able to do that in gspread.

Google has an example here: https://cloud.google.com/docs/authentication/production

` from google.cloud import storage

# If you don't specify credentials when constructing the client, the
# client library will look for credentials in the environment.
storage_client = storage.Client()

# Make an authenticated API request
buckets = list(storage_client.list_buckets())
print(buckets)`

For them it just works. No JSON necessary. Can this be replicated in any way in gspread?

[gpkc]

@niczky12 Maybe try the following:

• Check the type of creds: type(creds) it must return google.oauth2.service_account.Credentials
• Check the service account e-mail: creds.service_account_email it must be the service account email you expect
• Check if the spreadsheet is shared with that service account email (I assume that’s fine since you mentioned it works with JSON)

If the two first steps fail, make sure your Compute Engine / Google Kubernetes Engine / App Engine / Cloud Run / Cloud Function have the right service account set in its configurations. If you don’t do that you’ll have the default service account which might not be the same you’re trying to use.

If you want to test that on your local computer, try setting the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the service account. That’s not exactly what happens inside the google engines but google.auth.default should treat the same.

Finally, you can also try using from googleapiclient._auth import default_credentials instead of google.auth.default since that one is a bit more generic as it includes oauth2client.

[nissankarkifm]

@niczky12 Oops. I spoke too soon it seems. I’ve updated my comment. The code ran fine on my local machine so I assumed it’d work on a compute engine as well. I should’ve tested it. My bad.

When running the same code in a Compute Engine Instance, I get the following error.

APIError: {'code': 403, 'message': 'Request had insufficient authentication scopes.', 'status': 'PERMISSION_DENIED'}

The instance service account does have access to the google sheet I’m using.