-> Want more information about upgrading from `1.X` of the provider to `2.0.0`? Check out the [2.0.0 Upgrade Guide](https://terraform.io/docs/providers/google/version_2_upgrade.html).
*`credentials` - (Optional) The path or contents of a file that contains your
service account private key in JSON format. You can download your existing
[Google Cloud service account file] from the Google Cloud Console, or you can
create a new one from the same page.
Credentials can also be specified using any of the following environment
variables (listed in order of precedence):
*`GOOGLE_CREDENTIALS`
*`GOOGLE_CLOUD_KEYFILE_JSON`
*`GCLOUD_KEYFILE_JSON`
The [`GOOGLE_APPLICATION_CREDENTIALS`][adc]
environment variable can also contain the path of a file to obtain credentials
from.
If no credentials are specified, the provider will fall back to using the
[Google Application Default Credentials][adc].
If you are running Terraform from a GCE instance, see [Creating and Enabling
Service Accounts for Instances][gce-service-account] for details.
On your computer, if you have made your identity available as the
Application Default Credentials by running [`gcloud auth application-default
login`][gcloud adc], the provider will use your identity.
-> [Service accounts][service accounts] are the recommended way
to manage GCP credentials. [GCE metadata] is also acceptable, although it can
only be used when running Terraform from within [certain GCP resources](https://cloud.google.com/docs/authentication/production#obtaining_credentials_on_compute_engine_kubernetes_engine_app_engine_flexible_environment_and_cloud_functions).
Credentials obtained through `gcloud` are not guaranteed to work for all APIs.
*`access_token` - (Optional) An temporary [OAuth 2.0 access token](https://developers.google.com/identity/protocols/OAuth2)
obtained from the Google Authorization server, i.e. the
`Authorization: Bearer` token used to authenticate Google API HTTP requests.
Access tokens can also be specified using any of the following environment
variables (listed in order of precedence):
*`GOOGLE_OAUTH_ACCESS_TOKEN`
-> These access tokens cannot be renewed by Terraform and thus will only work for at most 1 hour. If you anticipate Terraform needing access for more than one hour per run, please use `credentials` instead. Credentials are used to complete a two-legged OAuth 2.0 flow on your behalf to obtain access tokens and can be used renew or reauthenticate for tokens as needed.