<p>In retrospect, this was actually fairly obvious but I guess the introduction of configuration files and their use of .env variables confused me.</p>
<p>If you want to use json file to authenticate to Google Cloud. Then all you need to do is:</p>
<ol>
<li>Secure the json in your server (place it somewhere the world won't be able to access it).</li>
<li>Add the path to your json in your <code>.env</code> file under the variable <code>GOOGLE_APPLICATION_CREDENTIALS</code></li>
<li>Configure your volume to use Google but leave the field <em><strong>Contents of access key file</strong></em> EMPTY. This value will be picked up automatically from the <code>.env</code>.</li>
<li>Click <strong>Refresh</strong> to confirm it sees the buckets and you're done.</li>
</ol>
<p>This way, your json file will be secure and out of your repo.</p>

CC BY-SA 4.0
2022-02-23T02:03:38.097Z
In local dev (relying on a physical `.env` file, as opposed to an injected environment on Heroku) I was still sort of "stuck" trying to short-circuit Project Config, environment vars, etc. Turns out the same advice applies—you can set `MY_GOOGLE_CLOUD_KEY_VAR` to an empty string in `.env` to basically skip Craft's processing of the key, and then set `GOOGLE_APPLICATION_CREDENTIALS` (the variable Google looks for in their own library) to a local file path, i.e. `/app/config/google.key`. Craft doesn't complain, and Google picks up the keyfile from the provided path!
August Miller
CC BY-SA 4.0
2021-11-02T15:52:47.437Z
2021-11-02T15:52:47.437Z
cballenar
<h2>Setup</h2>
<p>Craft CMS: 3.5.19.1
PHP: 7.2.24</p>
<p>This setup is in process of being updated to the latest version. I'm thinking the issue reported here may already be solved but I can't find any information on it. Hence I'm bringing it up.</p>
<h2>Issue</h2>
<ol>
<li>Contents of the Google Cloud Storage credentials.json file were updated to a single line and put in .env under the key GOOGLE_APPLICATION_CREDENTIALS. As seen below:</li>
</ol>
<pre><code>GOOGLE_APPLICATION_CREDENTIALS='{&quot;type&quot;: &quot;service_account&quot;,&quot;project_id&quot;: &quot;my-project&quot;,&quot;private_key_id&quot;: &quot;000000000000000&quot;,&quot;private_key&quot;: &quot;-----BEGIN PRIVATE KEY-----\n00000000000000000\n-----END PRIVATE KEY-----\n&quot;,&quot;client_email&quot;: &quot;my-service@my-project.iam.gserviceaccount.com&quot;,&quot;client_id&quot;: &quot;000000000000000&quot;,&quot;auth_uri&quot;: &quot;https://accounts.google.com/o/oauth2/auth&quot;,&quot;token_uri&quot;: &quot;https://accounts.google.com/o/oauth2/token&quot;,&quot;auth_provider_x509_cert_url&quot;: &quot;https://www.googleapis.com/oauth2/v1/certs&quot;,&quot;client_x509_cert_url&quot;: &quot;https://www.googleapis.com/my/path/my-service%40my-project.iam.gserviceaccount.com&quot;}'
</code></pre>
<ol start="2">
<li>This was good enough to refresh the bucket and saving successfully but upon attempting to upload new files it would result in the error below:</li>
</ol>
<pre><code>{
    &quot;error&quot;: {
        &quot;code&quot;: 403,
        &quot;message&quot;: &quot;Provided scope(s) are not authorized&quot;,
        &quot;errors&quot;: [
            {
                &quot;message&quot;: &quot;Provided scope(s) are not authorized&quot;,
                &quot;domain&quot;: &quot;global&quot;,
                &quot;reason&quot;: &quot;forbidden&quot;
            }
        ]
    }
}
</code></pre>
<ol start="4">
<li>I ended up copying the contents directly through the UI as the <a href="https://github.com/craftcms/google-cloud" rel="nofollow noreferrer">documentation in github seems to indicate</a> and it worked fine but this of course puts the keys into the project config files which now can't be committed to the repo.</li>
</ol>
<p><strong>Is this how I'm supposed to be running this? Any specifications when adding the credentials.json contents to the .env file?</strong></p>

CC BY-SA 4.0
2021-10-28T01:35:57.643Z
I have same issue before put the Google credentials to the .env. You can try to put the escase string instead of the raw value. so for example GOOGLE_APPLICATION_CREDENTIALS="{\"type\": \"service_account\"}"
aodihis
CC BY-SA 4.0
2021-10-28T10:10:35.203Z
I was hoping wrapping the json in single quotation marks would be sufficient but yeah I'll give that a shot :+1:
cballenar
CC BY-SA 4.0
2021-10-28T10:16:28.347Z
Nope... actually it resulted in a syntax error during the configuration of the volume. So the JSON reads just fine but still results in an authentication error... ONLY when read from .env... :\
cballenar
<volumes><storage><env>
Unable to use credentials.json from .env file for Google Cloud Storage
# Unable to use credentials.json from .env file for Google Cloud Storage

(Asked by: username_0 on 2021-10-27)

Setup
Craft CMS: 3.5.19.1
PHP: 7.2.24
This setup is in process of being updated to the latest version. I'm thinking the issue reported here may already be solved but I can't find any information on it. Hence I'm bringing it up.
Issue

Contents of the Google Cloud Storage credentials.json file were updated to a single line and put in .env under the key GOOGLE_APPLICATION_CREDENTIALS. As seen below:

GOOGLE_APPLICATION_CREDENTIALS='{"type": "service_account","project_id": "my-project","private_key_id": "000000000000000","private_key": "-----BEGIN PRIVATE KEY-----\n00000000000000000\n-----END PRIVATE KEY-----\n","client_email": "my-service@my-project.iam.gserviceaccount.com","client_id": "000000000000000","auth_uri": "https://accounts.google.com/o/oauth2/auth","token_uri": "https://accounts.google.com/o/oauth2/token","auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url": "https://www.googleapis.com/my/path/my-service%40my-project.iam.gserviceaccount.com"}'


This was good enough to refresh the bucket and saving successfully but upon attempting to upload new files it would result in the error below:

{
    "error": {
        "code": 403,
        "message": "Provided scope(s) are not authorized",
        "errors": [
            {
                "message": "Provided scope(s) are not authorized",
                "domain": "global",
                "reason": "forbidden"
            }
        ]
    }
}


I ended up copying the contents directly through the UI as the documentation in github seems to indicate and it worked fine but this of course puts the keys into the project config files which now can't be committed to the repo.

Is this how I'm supposed to be running this? Any specifications when adding the credentials.json contents to the .env file?

**Tags:** volumes, storage, env

> **Comments:**
> **username_1**: I have same issue before put the Google credentials to the .env. You can try to put the escase string instead of the raw value. so for example GOOGLE_APPLICATION_CREDENTIALS="{\"type\": \"service_account\"}"  
> **username_0**: I was hoping wrapping the json in single quotation marks would be sufficient but yeah I'll give that a shot :+1:  
> **username_0**: Nope... actually it resulted in a syntax error during the configuration of the volume. So the JSON reads just fine but still results in an authentication error... ONLY when read from .env... :\  

---

## 1 answers

### Answer by username_0 on 2021-11-02. Score: 3 | Accepted answer

In retrospect, this was actually fairly obvious but I guess the introduction of configuration files and their use of .env variables confused me.

If you want to use json file to authenticate to Google Cloud. Then all you need to do is:

1. Secure the json in your server (place it somewhere the world won't be able to access it).
2. Add the path to your json in your `.env` file under the variable `GOOGLE_APPLICATION_CREDENTIALS`
3. Configure your volume to use Google but leave the field ***Contents of access key file*** EMPTY. This value will be picked up automatically from the `.env`.
4. Click **Refresh** to confirm it sees the buckets and you're done.

This way, your json file will be secure and out of your repo.

> **Comments:**
> **username_2**: In local dev (relying on a physical `.env` file, as opposed to an injected environment on Heroku) I was still sort of "stuck" trying to short-circuit Project Config, environment vars, etc. Turns out the same advice applies—you can set `MY_GOOGLE_CLOUD_KEY_VAR` to an empty string in `.env` to basically skip Craft's processing of the key, and then set `GOOGLE_APPLICATION_CREDENTIALS` (the variable Google looks for in their own library) to a local file path, i.e. `/app/config/google.key`. Craft doesn't complain, and Google picks up the keyfile from the provided path!  

---

