GCP Pub/Sub多凭证使用：GOOGLE_APPLICATION_CREDENTIALS设置时机咨询

核心结论 #

不需要在每次pull或publish操作前修改GOOGLE_APPLICATION_CREDENTIALS环境变量，仅需在创建SubscriberClient和PublisherClient实例之前分别配置对应凭证即可；更推荐直接在初始化Client时传入凭证对象，彻底避免环境变量的全局冲突。

原理说明 #

Google Cloud Python客户端库（包括Pub/Sub的pubsub_v1）的凭证加载逻辑是：

• Client实例在初始化阶段会一次性读取并缓存凭证信息（无论是从环境变量、默认凭证链还是显式传入的凭证对象）
• 后续所有API调用（如pull、publish）都会复用该实例持有的凭证，不会重新读取环境变量或刷新凭证源（除非凭证过期自动刷新，但刷新时也会基于实例初始化时的配置）

代码实现示例 #

方式1：临时切换环境变量创建实例

from google.cloud import pubsub_v1
import os

project_id  = "my-project-id"
subscr_id_A = "subscribe-A"
topic_id_B  = "topic-B"

# 创建订阅客户端：先设置订阅用的凭证环境变量
os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = "/path/to/subscriber-service-account.json"
subscriber = pubsub_v1.SubscriberClient()
subscription_path = subscriber.subscription_path(project_id, subscr_id_A)

# 创建发布客户端：切换为发布用的凭证环境变量
os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = "/path/to/publisher-service-account.json"
publisher_options = pubsub_v1.types.PublisherOptions(enable_message_ordering=True)
publisher = pubsub_v1.PublisherClient(publisher_options=publisher_options)
topic_path = publisher.topic_path(project_id, topic_id_B)

# 后续循环操作无需修改环境变量
while True:
    response = subscriber.pull(subscription_path)
    # 处理消息逻辑...
  
    future = publisher.publish(topic_path, data=b"your-message-data")

方式2：直接传入凭证对象（更推荐，无全局环境变量干扰）

from google.cloud import pubsub_v1
from google.oauth2 import service_account

project_id  = "my-project-id"
subscr_id_A = "subscribe-A"
topic_id_B  = "topic-B"

# 加载订阅用的凭证
subscriber_credentials = service_account.Credentials.from_service_account_file(
    "/path/to/subscriber-service-account.json",
    scopes=["https://www.googleapis.com/auth/pubsub"]
)
subscriber = pubsub_v1.SubscriberClient(credentials=subscriber_credentials)
subscription_path = subscriber.subscription_path(project_id, subscr_id_A)

# 加载发布用的凭证
publisher_credentials = service_account.Credentials.from_service_account_file(
    "/path/to/publisher-service-account.json",
    scopes=["https://www.googleapis.com/auth/pubsub"]
)
publisher_options = pubsub_v1.types.PublisherOptions(enable_message_ordering=True)
publisher = pubsub_v1.PublisherClient(
    credentials=publisher_credentials,
    publisher_options=publisher_options
)
topic_path = publisher.topic_path(project_id, topic_id_B)

# 循环操作无需修改任何配置
while True:
    response = subscriber.pull(subscription_path)
    # 处理消息逻辑...
  
    future = publisher.publish(topic_path, data=b"your-message-data")

官方文档与测试依据 #

• 官方文档明确说明：Google Cloud客户端实例会在初始化时绑定凭证配置，后续调用复用该配置，不会受环境变量后续修改的影响。
• 测试验证：分别为两个Client实例配置不同服务账号后，通过云控制台的IAM审计日志可以看到，pull请求使用订阅服务账号的身份，publish请求使用发布服务账号的身份；即使后续修改环境变量，两个Client的请求身份也不会变化。

内容的提问来源于stack exchange，提问作者rlandster