您必須具備專案的 serviceusage.services.use IAM 權限，才能將該專案指定為帳單專案。serviceusage.services.use 權限已納入服務使用情形消費者 IAM 角色。如果您沒有任何專案的 serviceusage.services.use 權限，請與安全性管理員或專案擁有者聯絡，請對方為您授予專案中的「服務用量使用者」角色。
確認提出要求的主體是否具備必要的 IAM 角色。如果您使用使用者憑證，則必須將角色授予與使用者帳戶相關聯的電子郵件地址。如果您使用的是服務帳戶，則該服務帳戶必須具備必要的角色。
如果您在 API 要求中提供 API 金鑰，則該金鑰會優先於任何位置的 ADC。如果您已設定 GOOGLE_APPLICATION_CREDENTIALS 環境變數，且正在使用 API 金鑰，API 可能會傳回警告，指出您提供給 ADC 的憑證已遭到忽略。如要停止警告，請取消設定 GOOGLE_APPLICATION_CREDENTIALS 環境變數。
無法辨識的憑證類型
如果 API 要求傳回的錯誤訊息包含 Error creating credential
from JSON. Unrecognized credential type，請確認您使用的是有效的憑證。不支援使用用戶端 ID 檔案提供 ADC 的憑證。
模擬服務帳戶時，針對本機憑證傳回的錯誤
並非所有驗證程式庫都支援使用服務帳戶冒用功能產生的本機 ADC 檔案憑證。如果呼叫傳回的錯誤類似 Neither metadata server or valid service
account credentials are found，您就無法使用本任務的本機冒用憑證。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-02 (世界標準時間)。"],[[["\u003cp\u003eThis page covers common issues encountered when using Application Default Credentials (ADC), including problems with user credentials, incorrect credentials, unrecognized credential types, errors with service account impersonation, quota project issues, and access blocked by scopes.\u003c/p\u003e\n"],["\u003cp\u003eWhen using client-based APIs with user credentials, a quota project must be specified for billing and quota purposes; this can be set through the ADC file, the gcloud CLI config, or the \u003ccode\u003ex-goog-user-project\u003c/code\u003e HTTP header.\u003c/p\u003e\n"],["\u003cp\u003eIf user credentials are not working, ensure that the API is enabled in the specified project, and that the user has the \u003ccode\u003eserviceusage.services.use\u003c/code\u003e IAM permission or the Service Usage Consumer role.\u003c/p\u003e\n"],["\u003cp\u003eWhen troubleshooting credential access problems, confirm that the correct credentials are being used, the \u003ccode\u003eGOOGLE_APPLICATION_CREDENTIALS\u003c/code\u003e environment variable is set appropriately, the requesting principal has the required IAM roles, and that an API key isn't overriding ADC.\u003c/p\u003e\n"],["\u003cp\u003eIf you receive an "Access blocked" error when creating a local ADC file, check if you're using scopes unsupported by the default ADC setup, and if necessary, use an OAuth Client ID to add scopes for non-Google Cloud services.\u003c/p\u003e\n"]]],[],null,["This page describes some common problems you might encounter when using\nApplication Default Credentials (ADC).\n\nFor information about how ADC works, including where credentials are found, see\n[How Application Default Credentials works](/docs/authentication/application-default-credentials).\n\nUser credentials not working\n\nIf your API request returns an error message about user credentials not being\nsupported by this API, the API not being enabled in the project, or no quota\nproject being set, review the following information.\n\nThere are two kinds of Google Cloud APIs:\n\n- *Resource-based APIs*, which use the project associated with the resources\n being accessed for billing and quota.\n\n- *Client-based APIs*, which use the project associated with the client\n accessing the resources for billing and quota.\n\nWhen you provide user credentials to authenticate to a client-based API, you\nmust specify the project to use for billing and quota. This project is called\nthe *quota project*.\n\nThere are a number of ways to specify a quota project, including the following\noptions:\n\n- Update your ADC file to use a different project as the quota project:\n\n ```\n gcloud auth application-default set-quota-project YOUR_PROJECT\n ```\n- If you are using the gcloud CLI to call the API, you can set\n your quota project in your gcloud CLI config:\n\n ```\n gcloud config set billing/quota_project YOUR_PROJECT\n ```\n- If you are calling the REST or RPC API directly, use the\n `x-goog-user-project` HTTP header to specify a quota project in each\n request. For details, see\n [Set the quota project with a REST request](/docs/authentication/rest#set-billing-project).\n\n| **Note:** The API you are trying to use must be enabled in whatever project you specify.\n\n\nYou must have the `serviceusage.services.use` IAM permission for\na project to be able to designate it as your billing project. The\n`serviceusage.services.use` permission is included in the Service Usage Consumer\nIAM role. If you don't have the `serviceusage.services.use`\npermission for any project, contact your security administrator or a project\nowner who can give you the Service Usage Consumer role in the project.\n\nFor more information about quota projects, see\n[Quota project overview](/docs/quotas/quota-project). For information about additional ways\nto set the quota project, see [Set the quota project](/docs/quotas/set-quota-project).\n\nIncorrect credentials\n\nIf your credentials don't seem to be providing the access you expect, or aren't\nfound, check the following:\n\n- If you are using the gcloud CLI to access Google Cloud in a\n local environment, make sure you understand which credentials you are using.\n When you use the gcloud CLI, you are using the credentials you\n provided to the gcloud CLI by using the `gcloud auth login`\n command. You are not using the credentials you provided to ADC. For more\n information about these two sets of credentials, see\n [gcloud CLI authentication configuration and ADC configuration](/docs/authentication/gcloud#gcloud-credentials).\n\n- Make sure that the `GOOGLE_APPLICATION_CREDENTIALS` environment variable is\n set *only* if you are using a service account key or other JSON file for ADC.\n The credentials pointed to by the environment variable take precedence over\n other credentials, including for Workload Identity Federation for GKE.\n\n- Confirm that the principal making the request has the required\n IAM roles. If you are using user credentials, then the roles\n must be granted to the email address associated with the user account. If\n you are using a service account, then that service account must have the\n required roles.\n\n- If you provide an API key with the API request, the API key takes precedence\n over ADC in any location. If you have set the `GOOGLE_APPLICATION_CREDENTIALS`\n environment variable and you are using an API key, the API might return a\n warning telling you that the credentials you provided to ADC are being\n ignored. To stop the warning, unset the `GOOGLE_APPLICATION_CREDENTIALS`\n environment variable.\n\nUnrecognized credential type\n\nIf your API request returns an error that includes `Error creating credential\nfrom JSON. Unrecognized credential type`, make sure you are using a valid\ncredential. Client ID files are not supported to provide credentials for ADC.\n\nError returned for local credentials from service account impersonation\n\nCredentials from a local ADC file generated by using service account\nimpersonation are not supported by all of the authentication libraries. If your\ncall returns an error similar to `Neither metadata server or valid service\naccount credentials are found`, you can't use local impersonated credentials for\nthis task.\n\nTo avoid this error, create your ADC file from your user credentials or run your\ncode in an environment that has a metadata server available (such as\nCompute Engine).\n\nUnknown project `764086051850` used for request\n\nProject `764086051850` is the project used by the gcloud CLI. If you\nsee authentication errors referencing this project, you are trying to use\na client-based API and you have not set both your project and your quota\nproject for your configuration.\n\nFor more information, see [User credentials not working](#user-creds-client-based).\n\nAccess blocked when using scopes\n\nWhen you attempt to create a local ADC file, and an error similar to `This app\nis blocked` or `Access blocked: Authorization Error` is returned, you might be\nattempting to use scopes that aren't supported by the\n[default ADC setup command](/docs/authentication/set-up-adc-local-dev-environment#google-idp). Typically, this issue is caused by\nadding scopes for applications outside of Google Cloud, such as Google\nDrive.\n\n\nBy default, the access tokens generated from a local ADC file created with user credentials include\nthe [cloud-wide scope `https://www.googleapis.com/auth/cloud-platform`](/docs/authentication#authorization-gcp).\nTo specify scopes explicitly, you use the\n[`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)\nwith the `gcloud auth application-default login` command.\n\n\nTo add scopes for services outside of Google Cloud, such as Google Drive,\n[create an OAuth Client ID](https://support.google.com/cloud/answer/6158849)\nand provide it to the `gcloud auth application-default login` command by using the\n[`---client-id-file` flag](/sdk/gcloud/reference/auth/application-default/login#--client-id-file), specifying\nyour scopes with the [`---scopes` flag](/sdk/gcloud/reference/auth/application-default/login#--scopes)."]]
