Thanks for the patience @ljyanesm.

I am wondering if this logic works:

        # don't check `GOOGLE_APPLICATION_CREDENTIALS` since `google_default_auth` already does that

        # use explicit client
        if storage_client is not None:
            self.client = storage_client

        # use explicit credentials
        elif credentials is not None:
            self.client = StorageClient(credentials=credentials, project=project)

        # use explicit credential file
        elif application_credentials is not None:
            self.client = StorageClient.from_service_account_json(application_credentials)
        
        # use default credentials based on SDK precedence
        else:
            try:
                # use `google_default_auth` instead of `StorageClient()` since it
                # handles precedence of creds in different locations properly
                credentials, default_project = google_default_auth()
                project = project or default_project  # use explicit project if present
                self.client = StorageClient(credentials=credentials, project=project)            
            except DefaultCredentialsError:
                self.client = StorageClient.create_anonymous_client()

Also, can we update the docstring with whatever the precedence method we implement is and links to the google docs that explain what the SDK does?

Thanks @pjbull, just checked identity federation auth is working as well as key based auth.

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.3%. Comparing base (a4d47f9) to head (ae5d37f).
⚠️ Report is 6 commits behind head on 514-local.

❌ Your patch status has failed because the patch coverage (50.0%) is below the target coverage (80.0%). You can increase the patch coverage or adjust the target coverage.

@@             Coverage Diff             @@
##           514-local    #514     +/-   ##
===========================================
- Coverage       93.4%   92.3%   -1.1%     
===========================================
  Files             23      23             
  Lines           1800    1801      +1     
===========================================
- Hits            1682    1664     -18     
- Misses           118     137     +19     

@ljyanesm Not sure yet, but first look at failing tests suggests we may need to mock an additional part of the Google SDK to make the mocked tests work.

If you can repro locally and take a look that'd be great.

@pjbull

@ljyanesm Not sure yet, but first look at failing tests suggests we may need to mock an additional part of the Google SDK to make the mocked tests work.

If you can repro locally and take a look that'd be great.

I've tried to repro matching the python version (3.13), but could not get a repro locally.

In fact, locally only tests/test_s3_specific.py::test_aws_endpoint_url_env fails due to a mismatch in the S3 endpoint.

@ljyanesm New method is too smart!

In order to repro, I needed to:

• Remove any GC creds from my .env and active environment variables
• Move/rename .gscreds.json in my active directory
• gcloud auth revoke --all to revoke credentials
• gcloud auth application-default revoke to revoke/remove my default credentials.

After doing that on MacOS with Python 3.13 I get the same error as the test suite. I don't have the time to look into a fix quite yet, but maybe this could unblock you to investigate. Thanks!

Merging into a local branch to finish this PR