Google Cloud client libraries: local user ADC versus Cloud Run service account interoperability

Goal

Run the same Google Cloud client-library code locally and on Cloud Run without changing credential initialization. Locally, credentials come from gcloud auth application-default login; in production, Cloud Run supplies a default service account through the instance metadata server.

Constraints and uncertainty

Application Default Credentials resolution checks environment variables, local gcloud credentials, then the metadata server. A local user account and a production service account are not interchangeable identities, and IAM role grants do not carry over automatically. Client-library behavior can also vary by language and version, particularly for OAuth audiences and scopes.

Version assumption: the library follows the standard ADC resolution order. Practical verification: compare the effective credential type in each environment and review the production service account's IAM policy for the target resource.

Specific questions:

• Does the client library transparently switch from local user credentials to the production service account when running on Cloud Run?
• Must the production service account receive the same IAM roles granted to the local developer account for identical API access?
• Do differing OAuth audiences or scopes between user credentials and service account tokens require separate client configuration?