title: How should I handle private key files in Google AppEngine for service accounts?
body: <p>I need to use a Service Account in my Google AppEngine project (call it <strong>Home</strong>) from another Google AppEngine Project (call it <strong>Away</strong>) in order to access its Firestore database. To do that, all the documentation I can find tells me to download the Service Account's private key from <strong>Away</strong> and store it "<a href="https://cloud.google.com/iam/docs/creating-managing-service-account-keys" rel="nofollow noreferrer">in a location accessible to your application</a>". I can't find anywhere that documents what this means, exactly. </p>
  
  <p>Do I need to upload the <code>.json</code> private key file to the Google AppEngine server as part of deploying <strong>Home</strong>? How can I do that securely in Google AppEngine's environment? I can't find documentation anywhere about this.</p>
  
  <p>Alternatively, is there a way to create a Firestore client in Python using a JSON string instead of a file? That way I can store the JSON private key in the Datastore on <strong>Home</strong> instead.</p>