Craft CMS: PHP: 7.2.24

This setup is in process of being updated to the latest version. I'm thinking the issue reported here may already be solved but I can't find any information on it. Hence I'm bringing it up.


  1. Contents of the Google Cloud Storage credentials.json file were updated to a single line and put in .env under the key GOOGLE_APPLICATION_CREDENTIALS. As seen below:
GOOGLE_APPLICATION_CREDENTIALS='{"type": "service_account","project_id": "my-project","private_key_id": "000000000000000","private_key": "-----BEGIN PRIVATE KEY-----\n00000000000000000\n-----END PRIVATE KEY-----\n","client_email": "my-service@my-project.iam.gserviceaccount.com","client_id": "000000000000000","auth_uri": "https://accounts.google.com/o/oauth2/auth","token_uri": "https://accounts.google.com/o/oauth2/token","auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url": "https://www.googleapis.com/my/path/my-service%40my-project.iam.gserviceaccount.com"}'
  1. This was good enough to refresh the bucket and saving successfully but upon attempting to upload new files it would result in the error below:
    "error": {
        "code": 403,
        "message": "Provided scope(s) are not authorized",
        "errors": [
                "message": "Provided scope(s) are not authorized",
                "domain": "global",
                "reason": "forbidden"
  1. I ended up copying the contents directly through the UI as the documentation in github seems to indicate and it worked fine but this of course puts the keys into the project config files which now can't be committed to the repo.

Is this how I'm supposed to be running this? Any specifications when adding the credentials.json contents to the .env file?

  • I have same issue before put the Google credentials to the .env. You can try to put the escase string instead of the raw value. so for example GOOGLE_APPLICATION_CREDENTIALS="{\"type\": \"service_account\"}"
    – aodihis
    Oct 28, 2021 at 1:35
  • I was hoping wrapping the json in single quotation marks would be sufficient but yeah I'll give that a shot :+1:
    – cballenar
    Oct 28, 2021 at 10:10
  • Nope... actually it resulted in a syntax error during the configuration of the volume. So the JSON reads just fine but still results in an authentication error... ONLY when read from .env... :\
    – cballenar
    Oct 28, 2021 at 10:16

1 Answer 1


In retrospect, this was actually fairly obvious but I guess the introduction of configuration files and their use of .env variables confused me.

If you want to use json file to authenticate to Google Cloud. Then all you need to do is:

  1. Secure the json in your server (place it somewhere the world won't be able to access it).
  2. Add the path to your json in your .env file under the variable GOOGLE_APPLICATION_CREDENTIALS
  3. Configure your volume to use Google but leave the field Contents of access key file EMPTY. This value will be picked up automatically from the .env.
  4. Click Refresh to confirm it sees the buckets and you're done.

This way, your json file will be secure and out of your repo.

  • In local dev (relying on a physical .env file, as opposed to an injected environment on Heroku) I was still sort of "stuck" trying to short-circuit Project Config, environment vars, etc. Turns out the same advice applies—you can set MY_GOOGLE_CLOUD_KEY_VAR to an empty string in .env to basically skip Craft's processing of the key, and then set GOOGLE_APPLICATION_CREDENTIALS (the variable Google looks for in their own library) to a local file path, i.e. /app/config/google.key. Craft doesn't complain, and Google picks up the keyfile from the provided path! Feb 23 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.