title: Getting error using Google cloud client libraries for Go: unknown credential type: "impersonated_service_account"?
body: <p>I am working with Google Cloud in Go and following this article by John Hanley:</p>
  <p><a href="https://www.jhanley.com/google-cloud-improving-security-with-impersonation/" rel="nofollow noreferrer">https://www.jhanley.com/google-cloud-improving-security-with-impersonation/</a></p>
  <p>and mashed it with this SO answer:</p>
  <p><a href="https://stackoverflow.com/questions/63506885/how-to-authenticate-google-apis-google-drive-api-from-google-compute-engine-an/63507265#63507265">How to authenticate Google APIs (Google Drive API) from Google Compute Engine and locally without downloading Service Account credentials?</a></p>
  <p>The credentials are successfully saved to, &quot;application_default_credentials.json&quot;:</p>
  <p>Notice: &quot;type&quot;: &quot;<strong>impersonated_service_account</strong>&quot;</p>
  <pre><code>    {
    &quot;delegates&quot;: [],
    &quot;service_account_impersonation_url&quot;: &quot;https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/[sa@example-2021.iam.gserviceaccount.com]:generateAccessToken&quot;,
    &quot;source_credentials&quot;: {
      &quot;client_id&quot;: &quot;...apps.googleusercontent.com&quot;,
      &quot;client_secret&quot;: &quot;...&quot;,
      &quot;refresh_token&quot;: &quot;...&quot;,
      &quot;type&quot;: &quot;authorized_user&quot;
    },
    &quot;type&quot;: &quot;impersonated_service_account&quot;
  }
  </code></pre>
  <p>My code which produces an <strong>unknown credential type: &quot;impersonated_service_account&quot;</strong> error:</p>
  <pre><code>package main
  
  import (
  ...
      &quot;cloud.google.com/go/storage&quot;
      &quot;golang.org/x/oauth2&quot;
      &quot;google.golang.org/api/docs/v1&quot;
      &quot;google.golang.org/api/drive/v3&quot;
      &quot;google.golang.org/api/impersonate&quot;
      &quot;google.golang.org/api/option&quot;
  ...
  )
  
  var Config.GoogleServiceAccount string = &quot;sa@example-2021.iam.gserviceaccount.com&quot;
  
  
  
  
  func main(){
    _ = getTokenAsImpersonator()
  }
  
  // From: https://pkg.go.dev/google.golang.org/api/impersonate#example-CredentialsTokenSource-ServiceAccount
  func getTokenAsImpersonator() oauth2.TokenSource {
      ctx := context.Background()
  
      // Base credentials sourced from ADC or provided client options.
      ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
          TargetPrincipal: Config.GoogleServiceAccount,
          Scopes:          []string{&quot;https://www.googleapis.com/auth/cloud-platform&quot;},
          // Delegates: []string{&quot;bar@project-id.iam.gserviceaccount.com&quot;},
      })
      if err != nil {
          log.Fatal(err)
      }
  
      return ts
  }
  </code></pre>
  <p>The '<strong>unknown credential type: &quot;impersonated_service_account&quot;</strong>' error:</p>
  <pre><code>google: error getting credentials using GOOGLE_APPLICATION_CREDENTIALS environment variable: unknown credential type: &quot;impersonated_service_account&quot;
  
  </code></pre>
  <p>Have I done something wrong or is this a bug?</p>
  <hr />
  <p><strong>UPDATE</strong></p>
  <p>Answering John's questions from the comments:</p>
  <p>1.</p>
  <p>a) What is the value of the environment variable GOOGLE_APPLICATION_CREDENTIALS?</p>
  <pre><code>GOOGLE_APPLICATION_CREDENTIALS=/Users/x/.config/gcloud/application_default_credentials.json
  </code></pre>
  <p>b) What command did you use to generate application_default_credentials.json?</p>
  <pre><code>gcloud auth application-default login --scopes=https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/accounts.reauth,openid --impersonate-service-account=[sa@example-2021.iam.gserviceaccount.com]
  
  
  Response:
  
  Credentials saved to file: [/Users/x/.config/gcloud/application_default_credentials.json]
  
  
  </code></pre>
  <p>c)Which OS and version?</p>
  <pre><code>MacOS 10.13.6
  </code></pre>
  <p>d)gcloud --version?</p>
  <pre><code>Google Cloud SDK 343.0.0
  app-engine-go 
  app-engine-python 1.9.91
  bq 2.0.69
  cloud-datastore-emulator 2.1.0
  core 2021.05.27
  gsutil 4.62
  </code></pre>
  <ol start="2">
  <li>If you can create a minimum example ...</li>
  </ol>
  <p>I have updated the example code above.</p>