It's too difficult to create a client with anything but application Credentials.

For all our APIs, it should be simple to create a client with

1. Default application credentials. (implicitly)
2. A path to .json credentials.
3. Explicitly request Compute Engine credentials.

For an example, see the CloudLibrary class in https://github.com/GoogleCloudPlatform/dotnet-docs-samples/blob/master/auth/AuthSample/Program.cs.

In Pubsub, it was too difficult to create a client with a path to .json credentials:

 public static PublisherClient CreatePublisherWithServiceCredentials(string jsonPath)
        {
            GoogleCredential googleCredential = null;
            using (var jsonStream = new FileStream(jsonPath, FileMode.Open,
                FileAccess.Read, FileShare.Read))
            {
                googleCredential = GoogleCredential.FromStream(jsonStream)
                    .CreateScoped(PublisherClient.DefaultScopes);

                
            }

            return PublisherClient.Create(new Channel(PublisherClient.DefaultEndpoint.Host, PublisherClient.DefaultEndpoint.Port, googleCredential.ToChannelCredentials()));
        }

[jskeet]

Note: Google.Cloud.Datastore.V1 2.2.0-beta02 now includes a DatastoreClientBuilder and a DatastoreDbBuilder to show how this can be done more generally.

[jskeet]

I’m working on getting scopeless credentials fixed for gRPC clients. #1580 helps track how widespread the problem is. @LindaLawton the good news is that it seems to work for PubSub, so at least there you wouldn’t have a problem.

I beginning to wonder whether a simple CreateFromCredentialsFile(string file, FooSettings = null) method is the simplest fix here. I assume that having a file is the most common situation here.