title: Best auth strategy for GCP client tool
body: <p>I want to build a client gcp tool in python.</p>
  
  <p>I want to avoid invocations of the <code>glcoud</code> tool via <code>subprocess</code> so I opt for sdk <a href="https://github.com/googleapis/google-cloud-python" rel="nofollow noreferrer">client library</a> invocations.</p>
  
  <p>According to the docs as also <a href="https://www.jhanley.com/google-cloud-iam-listing-projects/" rel="nofollow noreferrer">this</a> very and comprehensive article, there are two options for auth:</p>
  
  <p>a) using the application default credentials (i.e. the ones used by <code>gcloud</code> under the hood)</p>
  
  <p>b) using a service account and pointing the app to the corresponding <code>.json</code> file.</p>
  
  <p>I have already tried the (a) and got the following warning:</p>
  
  <blockquote>
    <p>UserWarning: Your application has authenticated using end user
    credentials from Google Cloud SDK. We recommend that most server
    applications use service accounts instead. If your application
    continues to use end user credentials from Cloud SDK, you might
    receive a "quota exceeded" or "API not enabled" error. For more
    information about service accounts, see
    <a href="https://cloud.google.com/docs/authentication/" rel="nofollow noreferrer">https://cloud.google.com/docs/authentication/</a><br>
    warnings.warn(_CLOUD_SDK_CREDENTIALS_WARNING)</p>
  </blockquote>
  
  <p>If I use app default creds, this makes it easy since each end user the app will be distributed to, will have this <code>.json</code> file a source of truth for his/her auth process. However, the app may encounter the above <code>quota exceeded</code> error.</p>
  
  <p>In the other case, (service account specific credentials) I assume I will have to provide instructions to each developer to issue a json file that corresponds to a service account with the exact same permission as his/hers. And what about the update process? What happens each time a user gets assigned / revoked some permissions? How this json stays in sync?</p>
  
  <p>Any advice about this would be highly appreciated.</p>