Where apps hide your files

Finding the gcloud config directory

Updated 2026-10-28 · 6 min read

gcloud stores your accounts, named configurations and application default credentials in one hidden folder in your home directory. Here is where it is, what the files are for, and how to look around without exposing anything secret.

The location

~/.config/gcloud

Google's documentation gives this as the typical location on macOS and Linux. The folder sits inside the hidden .config folder, so Finder does not show it. Open it with Go > Go to Folder (⇧⌘G), paste ~/.config/gcloud and press Return. From Terminal:

open ~/.config/gcloud

If you would rather ask gcloud itself, this prints the exact path in use:

gcloud info --format='value(config.paths.global_config_dir)'

If the folder is missing, gcloud has not been run on your Mac yet, or the CLOUDSDK_CONFIG environment variable points somewhere else. That variable is the documented way to relocate the whole folder, and the directory it names must be writable.

Application default credentials

The file most people are hunting for is the one that client libraries and tools such as Terraform pick up automatically. Google documents its location on macOS and Linux as:

~/.config/gcloud/application_default_credentials.json

gcloud auth application-default login creates it. It is separate from the credentials the gcloud command line uses for its own sign-in, which is why gcloud auth login alone does not make your code work locally, and why signing out of one does not sign you out of the other.

Libraries check the GOOGLE_APPLICATION_CREDENTIALS environment variable first. If it names a JSON file (a service account key or a federation config), that file wins over the one above. Only after both comes the attached service account, which applies on Google Cloud machines, not on your Mac.

What else is in the folder

The layout differs a little between gcloud versions, so read this as a typical install and not a promise:

Name	What it is
configurations/	One small file per named configuration, such as config_default. These hold properties like project and region.
active_config	A one-line file naming the configuration currently in use.
credentials.db, access_tokens.db	SQLite databases holding the accounts you signed in with and their short-lived tokens. Sensitive.
application_default_credentials.json	The ADC file described above. Sensitive.
logs/	Dated folders of gcloud's own log files.
legacy_credentials/	Per-account folders in older layouts. Sensitive.

To list names, sizes and permissions without showing a single value, use:

ls -la ~/.config/gcloud

Avoid cat on anything with credentials, tokens or application_default in its name. Those files can contain a refresh token or a private key, and anyone holding one can act as you. Never paste them into a chat, an issue or a screenshot.

To see your settings the supported way:

gcloud config list
gcloud config configurations list

Both print properties and configuration names, not secrets.

Where gcloud itself lives

The config folder is separate from the program. If you used Google's archive, the program is wherever you extracted it; Google's install guide says a common choice is your home folder, which gives ~/google-cloud-sdk. If you used Homebrew, the cask is now called gcloud-cli (the old google-cloud-sdk name redirects to it), and Homebrew's notes for it place the SDK in /opt/homebrew/share/google-cloud-sdk on Apple silicon. An Intel Mac, or a Homebrew running under Rosetta, uses /usr/local instead of /opt/homebrew. To see which copy your shell runs:

which gcloud

Moving or reinstalling the program does not touch ~/.config/gcloud.

Moving or resetting the config

To keep several independent setups (work and personal, say), point CLOUDSDK_CONFIG at a different folder in the shell where you need it, then run gcloud init there:

export CLOUDSDK_CONFIG="$HOME/.config/gcloud-work"
gcloud init

Each folder then holds its own accounts and configurations. The export lasts only for that Terminal tab. For a quick switch inside one folder, named configurations are simpler: gcloud config configurations activate <name>.

To start fresh, sign out first. gcloud auth revoke on its own signs out only the active account, so use gcloud auth revoke --all for every account, and gcloud auth application-default revoke for the ADC file. Then quit any running gcloud commands and move the folder to the Trash in Finder. gcloud recreates it on the next run, and you will have to sign in again.

Backups and a new Mac

Do not copy credentials.db or the ADC file to a new Mac, or into a cloud drive or a Git repository. Sign in again on the new machine with gcloud auth login and gcloud auth application-default login. If you want to carry over your settings, the files in configurations/ normally hold only properties such as project and region, and are reasonable to copy. Look at each one yourself first to confirm there is nothing you would not want to share.

Time Machine backs up hidden folders in your home folder, so your tokens will be inside your backup. Encrypt that backup.

Why a normal search misses it

.config is a hidden dot-folder, so Spotlight and Finder searches leave its contents out, and the files inside have plain names that do not look related to Google.

Finding it again

Typing application_default or gcloud into Everywhere lists the ADC file and the config folder even though they sit in a hidden folder, and ⌘↵ reveals one in Finder. It matches file names only, so it will not show which account is active; gcloud config list answers that.

Common questions

Where is the gcloud config directory on a Mac?

In ~/.config/gcloud, a hidden folder in your home directory. Open it with Go to Folder (⇧⌘G) or open ~/.config/gcloud.

Where are application default credentials stored on macOS?

In ~/.config/gcloud/application_default_credentials.json, created by gcloud auth application-default login. Treat it like a password.

How do I change where gcloud stores its config?

Set the CLOUDSDK_CONFIG environment variable to a writable folder before running gcloud. Each folder then keeps its own accounts and configurations.

Is it safe to delete ~/.config/gcloud?

Yes, if you accept signing in again. Sign out first with gcloud auth revoke --all and gcloud auth application-default revoke, then move the folder to the Trash; gcloud recreates it on the next run.