Google authentication

Looks for credentials in the following places, preferring the first location found:

• A JSON file whose path is specified by the GOOGLE_APPLICATION_CREDENTIALS environment variable.
• A JSON file in a location known to the gcloud command-line tool using gcloud auth application-default login.
• On Google Compute Engine, it fetches credentials from the metadata server.

Local development

Don’t confuse gcloud auth login with gcloud auth application-default login for local development, since the first authorize only gcloud tool to access the Cloud Platform.

The latter obtains user access credentials via a web flow and puts them in the well-known location for Application Default Credentials (ADC). This command is useful when you are developing code that would normally use a service account but need to run the code in a local development environment where it’s easier to provide user credentials. So to work for local development you need to use gcloud auth application-default login.

Crypto provider

Service account keys sign their tokens with a rustls crypto provider. The auth-default-crypto feature, on by default, brings the aws-lc-rs provider of google-cloud-auth. Be aware that aws-lc-rs is built from C sources.

With default-features = false, either enable the feature next to your TLS feature:

[dependencies]
firestore = { version = "0.63", default-features = false, features = ["tls-webpki-roots", "auth-default-crypto"] }

or install a rustls CryptoProvider before creating a client. Without a provider FirestoreDb::new, FirestoreDb::with_options and FirestoreDb::with_options_service_account_key_file return an error with the code CryptoProviderMissing for a service account key. Credentials you build yourself with the google-cloud-auth builders panic on their first token request instead, so build them with GoogleAuthHeaders::from_service_account_key to get the same error.