gcloud auth login: Usage & Common CI Errors

Interactively authenticate gcloud - and why CI should not use it.

gcloud auth login authenticates the gcloud CLI with a Google user account via a browser flow. It is great for laptops but the wrong tool for CI, which should use service accounts or Workload Identity Federation.

What it does

gcloud auth login opens a browser to obtain user credentials and stores them for gcloud. The related gcloud auth application-default login writes Application Default Credentials used by client libraries. Both are interactive and user-scoped - distinct from service-account credentials used by automation.

Common usage

# Interactive user login (local dev)
gcloud auth login

# Application Default Credentials for local SDK/library use
gcloud auth application-default login

# List who is authenticated
gcloud auth list

Common error in CI: "does not detect a browser" / using login in automation

In CI, gcloud auth login fails with "You do not currently have an active account selected" or hangs because it "cannot launch a browser" on a headless runner. Fix: do not use gcloud auth login in CI. Use Workload Identity Federation with google-github-actions/auth (no keys), or gcloud auth activate-service-account --key-file=key.json if you must use a key. Reserve gcloud auth login (and application-default login) for interactive local development only.

Key options

Related guides