It is a JSON file that gcloud auth application-default login writes so your code can authenticate as you during local development. On Linux and macOS it lives at $HOME/.config/gcloud/application_default_credentials.json, on Windows under %APPDATA%\gcloud, and any program running as your user can read it.
What Application Default Credentials means
Application Default Credentials, or ADC, is the way Google Cloud client libraries decide which credentials to use without you passing them in code. Google documents three places it looks, in this order:
- The file named by the
GOOGLE_APPLICATION_CREDENTIALSenvironment variable. - The local file created by
gcloud auth application-default login. - The service account attached to the resource the code runs on, found through the metadata server.
The same code can therefore run on your laptop with your identity and in production with an attached service account, with no changes.
Why the local file deserves attention
The local file carries your user's access, not a narrow role for one app. Whatever your Google account can do in a project, a script reading that file can do too. Because it sits in your home directory, a malicious dependency or editor extension can read it without any special permission.
Google's documentation also says service account keys are discouraged, because a leaked key can be used without any other information. A key file pointed to by the environment variable is the riskiest variant, because it is a standing secret that anyone holding the file can use.
Habits that reduce the risk
| Habit | Why |
|---|---|
| Prefer your own login for local work over downloaded key files | No long lived key lands on disk |
Check whether GOOGLE_APPLICATION_CREDENTIALS is set in your shell profile | A forgotten variable silently overrides the local file |
| Sign out and remove the file when you finish a sensitive task | Shrinks the window |
| In production, use an attached service account | Google calls this the preferred method in production |
| Work in a project with limited permissions when testing | Limits what the file can do |
Steps to check your machine
- Look for the file at the path above. If it exists, note its last modified date.
- Print the environment variable. If it points to a key file, find out why, and whether the key can be replaced.
- Run your tools once and confirm which identity they use.
- Remove the file if you no longer need it, and sign in again when you do.
See also which files on a developer laptop hold credentials.
Safeguard's dependency scanning and SBOMs show which packages in a project could run code with your rights. Try a free scan at gold.safeguard.sh/scan.
Quick check
Does ADC mean the credential is shared with other people?
No. It is a lookup method. The local file belongs to your user account and is only on your machine.
Which wins, the environment variable or the local file?
Per Google's documented order, the environment variable is checked first.
Sources
Last reviewed: 19 October 2026.
