title: Obtain a service account credentials within a Cloud Functions to call a google service outside GCP
body: <p>My scenario: I need to call the Google DBM API using <code>google-api-python-client</code> from a Cloud Function using a service account.</p>
  <p><strong>Update</strong></p>
  <p>Here the sample code I trying to run:</p>
  <pre><code>import google.auth
  from googleapiclient.discovery import build
  from google.auth.transport import requests
  
  API_NAME = 'doubleclickbidmanager'
  API_VERSION = 'v1.1'
  SCOPES = ['https://www.googleapis.com/auth/doubleclickbidmanager']
  
  credentials, project_id = google.auth.default(scopes=SCOPES)
  
  print(credentials.service_account_email)
  # prints &quot;default&quot;
  
  credentials.refresh(requests.Request())
  print(credentials.service_account_email)
  # prints &quot;[service-account]@[project].iam.gserviceaccount.com&quot;
  
  service = build(API_NAME, API_VERSION, credentials=credentials)
  service.queries().listqueries().execute()
  # local: return the queries
  # in CF: Encountered 403 Forbidden with reason &quot;insufficientPermissions&quot;
  </code></pre>
  <p>When I run locally setting the environment variable <code>GOOGLE_APPLICATION_CREDENTIALS=keyfile.json</code> works fine.</p>
  <p>But when running in the Cloud Function I got the 403 error.</p>
  <p>The <code>keyfile.json</code> use the same service account <code>[service-account]@[project].iam.gserviceaccount.com</code> setted in the Cloud Function.</p>