GCP GoogleCredential与GoogleCredentials互转及差异原因咨询

Great question! I’ve run into this exact scenario when working with mixed GCP Java clients, so let me break this down for you.

Yes, you absolutely can convert between GoogleCredential (from the old google-api-client library) and GoogleCredentials (from the modern google-auth-library-oauth2-http library) without managing separate credential instances. Here are the most common scenarios:

From GoogleCredentials to GoogleCredential #

If you’re starting with the modern GoogleCredentials (used by BigQuery’s new client), converting depends on the credential type:

For Service Account Credentials #

This is the most straightforward case, since both libraries support service account auth natively:

// Fetch or initialize your modern GoogleCredentials
GoogleCredentials modernCreds = GoogleCredentials.getApplicationDefault();

// Convert to GoogleCredential (cast to ServiceAccountCredentials first)
GoogleCredential legacyCred = GoogleCredential.fromServiceAccountCredential(
    (ServiceAccountCredentials) modernCreds
);

For User Credentials #

If you’re using user OAuth2 credentials (like from a refresh token), you’ll need to build the legacy credential manually using the details from the modern one:

UserCredentials userModernCreds = (UserCredentials) modernCreds;

GoogleCredential legacyUserCred = new GoogleCredential.Builder()
    .setClientSecrets(
        userModernCreds.getClientId(),
        userModernCreds.getClientSecret()
    )
    .setAccessToken(new AccessToken(
        userModernCreds.getAccessToken().getTokenValue(),
        userModernCreds.getAccessToken().getExpirationTime()
    ))
    .setRefreshToken(userModernCreds.getRefreshToken())
    .build();

From GoogleCredential to GoogleCredentials #

Going the other way is also possible, again depending on the credential type:

For Service Account Credentials #

Extract the private key and service account details to build the modern credential:

GoogleCredential legacyCred = ...; // Your existing legacy credential

ServiceAccountCredentials modernCred = ServiceAccountCredentials.fromPkcs8(
    legacyCred.getServiceAccountId(),
    legacyCred.getServiceAccountPrivateKey(),
    legacyCred.getServiceAccountPrivateKeyId(),
    legacyCred.getTokenServerEncodedUrl(),
    null, // Scopes (optional, can set if needed)
    null
);

Quick-and-Dirty Token-Based Conversion (For Any Credential Type) #

If you just need a short-lived usable credential (without automatic refresh), you can create a temporary GoogleCredentials from the legacy credential’s access token:

GoogleCredential legacyCred = ...;

AccessToken accessToken = new AccessToken(
    legacyCred.getAccessToken(),
    new Date(legacyCred.getExpirationTimeMilliseconds())
);
GoogleCredentials modernCred = GoogleCredentials.create(accessToken);

Note: This won’t handle token refresh automatically, so use it only for short-lived operations or if you’re already handling refresh elsewhere.

The split between GoogleCredential and GoogleCredentials comes down to GCP’s evolution of its authentication libraries:

• GoogleCredential (legacy, from google-api-client): This was the original credential class built for early GCP APIs. It’s a monolithic class that tightly couples credential logic with HTTP request handling. It was designed to work with the older generation of GCP API clients (like the Transfer API’s legacy client) but lacks flexibility for modern use cases (e.g., workload identity, multi-cloud auth, or modular credential types).

• GoogleCredentials (modern, from google-auth-library-oauth2-http): This is a ground-up redesign of GCP’s auth system. It uses a modular approach, with separate classes for different credential types (ServiceAccountCredentials, UserCredentials, ComputeEngineCredentials, etc.), each with its own refresh and authentication logic. It’s decoupled from specific API clients, making it usable across all modern GCP Java libraries (like the new BigQuery client). This design also supports newer GCP features that the legacy library couldn’t handle easily.

The coexistence is a transition phase while GCP migrates all its client libraries to the modern auth system. Over time, most APIs (including Transfer API) will move to using GoogleCredentials, but for now, we need to handle both types.

内容的提问来源于stack exchange，提问作者Vitali Melamud