[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eThe gcloud CLI, a command-line tool for Google Cloud administration, requires different sign-in methods based on the environment: local, Cloud Shell, or Google Cloud compute resources.\u003c/p\u003e\n"],["\u003cp\u003eIn local environments, users can sign in to the gcloud CLI using either their user credentials or a service account, with the tool storing access tokens in the user's home directory.\u003c/p\u003e\n"],["\u003cp\u003eCloud Shell users do not need to sign in to the gcloud CLI but must authorize their account for development tools, while compute resources automatically provide credentials to the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud auth login\u003c/code\u003e command authenticates the gcloud CLI for accessing Google Cloud, whereas \u003ccode\u003egcloud auth application-default login\u003c/code\u003e configures Application Default Credentials (ADC) for the local environment.\u003c/p\u003e\n"],["\u003cp\u003eWorkforce and Workload Identity Federation allow users and workloads outside of Google Cloud to access resources, and the gcloud CLI supports signing in using these methods.\u003c/p\u003e\n"]]],[],null,["This page describes various ways to sign in to the gcloud CLI.\nThe Google Cloud CLI is a command-line tool you can use for Google Cloud\nadministration. Most services support the gcloud CLI.\n\nIf you plan to use client libraries or third-party development tools that\nsupport Application Default Credentials (ADC) in a local development\nenvironment, you need to configure ADC in your local environment. For more\ninformation, see\n[Set up Application Default Credentials for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\nHow you authenticate to and use the gcloud CLI depends on where you\nare running the tool:\n\n- [In a local environment](#local)\n- [Using Cloud Shell](#cloud-shell)\n- [On Google Cloud compute resources](#on-gcp)\n\nLocal environment\n\nFor most use cases, you can use your user credentials to\nsign in to the gcloud CLI, but you can also use a service account.\n\nWhen you sign in to the gcloud CLI in a local environment, the tool\nplaces your access and refresh tokens in your home directory. Any user with\naccess to your file system can use those credentials. For more information, see\n[Mitigating compromised OAuth tokens for Google Cloud CLI](/architecture/bps-for-mitigating-gcloud-oauth-tokens).\n\nThe following table describes your options for signing in to the\ngcloud CLI and how that affects the credentials used by the tool\nto authenticate and authorize to Google APIs.\n\n| Credential type | Authentication command | Notes | More information |\n|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| User credentials | One of the following: - [`gcloud init`](/sdk/gcloud/reference/init): Authorizes access and performs other common setup steps. - [`gcloud auth login`](/sdk/gcloud/reference/auth/login): Authorizes access only. | The gcloud CLI uses your user credentials for authentication and authorization for all Google APIs. To use a service account for authorization to Google APIs, use [service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud). | - [Initialize the gcloud CLI](/sdk/docs/initializing) - [Use service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud) |\n| User credentials | 1. `gcloud config set auth/login_config_file `\u003cvar translate=\"no\"\u003eWORKFORCE_IDENTITY_FEDERATION_LOGIN_CONFIGURATION_FILE\u003c/var\u003e 2. [`gcloud auth login`](/sdk/gcloud/reference/auth/login) | Workforce Identity Federation enables users managed by an identity provider other than Google to access Google Cloud resources. | - [Sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud) - [Workforce Identity Federation](/iam/docs/workforce-identity-federation) |\n| Service account | [`gcloud auth login --cred-file=`\u003cvar translate=\"no\"\u003eWORKLOAD_IDENTITY_FEDERATION_CREDENTIAL_FILE\u003c/var\u003e](/sdk/gcloud/reference/auth/login) | Workload Identity Federation enables workloads running outside of Google Cloud to access Google Cloud resources. | [Authenticate a workload](/iam/docs/workload-identity-federation-with-other-providers#authenticate) |\n| Service account | [`gcloud auth login --cred-file=`\u003cvar translate=\"no\"\u003eSERVICE_ACCT_KEY\u003c/var\u003e](/sdk/gcloud/reference/auth/login) | This method is not recommended, because using service account keys increases risk. To use a service account for authorization to Google APIs, sign in to the gcloud CLI with your user credentials, and then use [service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud). | - [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys) - [Use service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud) |\n\nCloud Shell\n\nWhen you use Cloud Shell, you don't need to sign in to the\ngcloud CLI, but you do need to authorize the use of your account\nbefore using any development tools from Cloud Shell. After you do that,\nthe gcloud CLI uses your user credentials to access Google APIs.\n\nFor more information, see [Authorize with Cloud Shell](/shell/docs/auth).\n\n\nGoogle Cloud compute resources\n\nWhen you use the gcloud CLI on Google Cloud compute resources\nsuch as Compute Engine virtual machines, you don't need to initialize or sign\nin to the gcloud CLI, because it gets its credentials and\nconfiguration information from the hosting compute resource by using the\nmetadata server.\n\n| Credential type | Authentication command | Notes | More information |\n|-----------------|------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|\n| Service account | Not applicable | The gcloud CLI uses the service account attached to the compute resource for authentication and authorization for all Google APIs. | [Set up ADC for a resource with an attached service account](/docs/authentication/set-up-adc-attached-service-account) |\n\ngcloud CLI authentication configuration and ADC configuration\n\nWhen you sign in to the gcloud CLI, you use the\n[`gcloud auth login` command](/sdk/gcloud/reference/auth/login) to authenticate a principal to the gcloud CLI.\nThe gcloud CLI uses that principal for authentication and authorization to\nmanage Google Cloud resources and services. This is your *gcloud CLI authentication configuration*.\n\nWhen you use the gcloud CLI to configure ADC, you use\nthe [`gcloud auth application-default login`](/sdk/gcloud/reference/auth/application-default/login) command. This\ncommand uses the principal you provide to configure ADC for your\nlocal environment. This is your *ADC configuration*.\n\nYour gcloud CLI authentication configuration is distinct from your\nADC configuration. They can use the same principal or different principals. The\ngcloud CLI does not use ADC to access Google Cloud resources.\n\nThe following table shows the two commands and what they do:\n\n| Command | Description |\n|-------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|\n| [`gcloud auth login`](/sdk/gcloud/reference/auth/login) | Accepts credentials that are used to authenticate to and authorize access to Google Cloud services. |\n| [`gcloud auth application-default login`](/sdk/gcloud/reference/auth/application-default/login) | Generates a local ADC file based on the credentials you provide to the command. |\n\nGenerally you use the same account to sign in to the gcloud CLI\nand to configure ADC, but you can use different accounts if needed.\n\nWhat's next\n\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n- [Authenticate for using Cloud Client Libraries](/docs/authentication/client-libraries).\n- Explore [authentication methods](/docs/authentication)."]]
