AppIdentity Credential vs Application Default Credentials

[Nicola Spreafico]

Hi,

I'm unable to properly understand the differences between this 2 authentication methods:

AppIdentity: https://cloud.google.com/appengine/docs/standard/java/appidentity/#asserting_identity_to_google_apis

Application Default Credentials: https://developers.google.com/identity/protocols/application-default-credentials#whentouse

My use case is use the Google APIs with the App Engine application itself as authenticated user.

As far I can understand, with Application Default Credentials I can create an "hybrid" code that can work in both local and online environment (in local the user will be my own, configured in GCloud, and online will be the application).

The AppIdentity method instead does not work in local enviroment.

The AppIdentify only provides and accessToken (but a Credential object can be built using this token)

The ApplicationDefaultCredentials directly provides a Credential object

is there a comparison chart available?

[Nick (Cloud Platform Support)]

Hey Nicola,

There's no comparison chart, but your post itself has correctly discerned the major differences. AppIdentity is used to assert the identity of the application in production, and uses the default App Engine service account. Application Default Credentials in a deployed App Engine app will also use this same identity, however (as you noticed), in dev, Application Default Credentials will use the gcloud credentials.

Regards,

Nick
Cloud Platform Community Support