.NET 7 API本地可访问Firebase，Docker部署后GOOGLE_APPLICATION_CREDENTIALS认证失败

我有一个.NET 7.0 API，通过GOOGLE_APPLICATION_CREDENTIALS环境变量访问Firebase执行查询。本地使用同一认证JSON文件可以正常查询，但部署到Docker容器后执行相同查询时，抛出认证错误：

"Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential."

需要确认问题出在Docker镜像的环境变量配置，还是Google Cloud API与服务设置上。曾按照错误提示指引创建OAuth 2.0凭证但未解决，且本地运行完全正常。

Dockerfile内容 #

...
ENV GOOGLE_APPLICATION_CREDENTIALS=/app/Credential-7291824fb310.json
ENV PROJECT_ID=XXXXXXXXX

WORKDIR /app
COPY --from=build /app/dist/ /app
COPY ./Credential-7291824fb310.json .

EXPOSE 5002

ENTRYPOINT ["dotnet", "myAPP.API.dll"]

错误堆栈信息 #

fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HN8NVLQG0G1Q", Request id "0HN8NVLQG0G1Q:00000002": An unhandled exception was thrown by the application.
      Grpc.Core.RpcException: Status(StatusCode="Unauthenticated", Detail="Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.")
         at Grpc.Net.Client.Internal.HttpContentClientStreamReader`2.MoveNextCore(CancellationToken cancellationToken)
         at Google.Api.Gax.Grpc.AsyncResponseStream`1.MoveNextAsync(CancellationToken cancellationToken)
         at Google.Cloud.Firestore.Query.StreamResponsesAsync(ByteString transactionId, CancellationToken cancellationToken, Boolean allowLimitToLast)+MoveNext()
         at Google.Cloud.Firestore.Query.StreamResponsesAsync(ByteString transactionId, CancellationToken cancellationToken, Boolean allowLimitToLast)+MoveNext()
         at Google.Cloud.Firestore.Query.StreamResponsesAsync(ByteString transactionId, CancellationToken cancellationToken, Boolean allowLimitToLast)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()
         at System.Linq.AsyncEnumerable.<ForEachAsync>g__Core|99_0[TSource](IAsyncEnumerable`1 source, Action`1 action, CancellationToken cancellationToken) in /_/Ix.NET/Source/System.Linq.Async/System/Linq/Operators/ForEach.cs:line 41
         at System.Linq.AsyncEnumerable.<ForEachAsync>g__Core|99_0[TSource](IAsyncEnumerable`1 source, Action`1 action, CancellationToken cancellationToken) in /_/Ix.NET/Source/System.Linq.Async/System/Linq/Operators/ForEach.cs:line 41
         at Google.Cloud.Firestore.Query.GetSnapshotAsync(ByteString transactionId, CancellationToken cancellationToken)

优先检查Docker侧配置问题 #

• 验证凭证文件完整性
  启动容器后进入内部，执行cat /app/Credential-7291824fb310.json查看文件内容是否和本地完全一致，避免构建镜像时文件路径错误导致复制的文件为空或损坏。
• 确认环境变量生效状态
  在容器内执行echo $GOOGLE_APPLICATION_CREDENTIALS，输出需等于/app/Credential-7291824fb310.json；同时检查PROJECT_ID是否与凭证文件中的project_id字段完全匹配。
• 调整环境变量设置顺序
  可尝试将ENV指令移到WORKDIR和COPY之后，避免路径解析异常：

  WORKDIR /app
  COPY --from=build /app/dist/ /app
  COPY ./Credential-7291824fb310.json .
  
  ENV GOOGLE_APPLICATION_CREDENTIALS=/app/Credential-7291824fb310.json
  ENV PROJECT_ID=XXXXXXXXX
  
  EXPOSE 5002
  ENTRYPOINT ["dotnet", "myAPP.API.dll"]
  

检查Google Cloud服务配置 #

• 确认服务账号权限
  本地能正常运行说明凭证本身有效，但要确保该凭证对应的服务账号拥有Firebase Firestore的读写权限（如Cloud Datastore User或Firebase Admin角色），可在Google Cloud控制台IAM页面查看并调整权限。
• 无需手动创建OAuth 2.0凭证
  使用GOOGLE_APPLICATION_CREDENTIALS时，SDK会自动通过服务账号凭证生成OAuth 2.0令牌，不需要手动创建OAuth客户端ID，之前创建的相关凭证可忽略。
• 检查API启用状态
  确认Google Cloud控制台中，Cloud Firestore API已启用，避免因API未开启导致的认证失败。

代码侧验证（可选） #

若上述排查无问题，可在API启动时添加日志，确认SDK是否正确加载凭证：

var credential = GoogleCredential.GetApplicationDefault();
Console.WriteLine($"Loaded credential type: {credential.UnderlyingCredential.GetType().Name}");
Console.WriteLine($"Current project ID: {Environment.GetEnvironmentVariable("PROJECT_ID")}");

内容的提问来源于stack exchange，提问作者PHP