gcloud auth application-default print-access-token not finding my environment variable

I am working on following the steps for Google Cloud Text to Speech via curl as described here.

I have a Service Account with its key in google-credentials.json (this currently works for Google Cloud Storage).

in Terminal I set the GOOGLE_APPLICATION_CREDENTIALS environment variable two different ways:

1. While within the application working directory, I set it to:

   GOOGLE_APPLICATION_CREDENTIALS="google-credentials.json"

or

2. Setting the absolute path

   GOOGLE_APPLICATION_CREDENTIALS="~/Projects/dbsan2/google-credentials.json"

Performaning

echo $GOOGLE_APPLICATION_CREDENTIALS

returns the given value I set it to.

Running nano $GOOGLE_APPLICATION_CREDENTIALS only opens the file for the first approach, the second opens a blank document.

running the following command as described in the article above:

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    -d @request.json \
    "https://texttospeech.googleapis.com/v1/text:synthesize"

WARNING: Compute Engine Metadata server unavailable on attempt 1 of 3. Reason: timed out
WARNING: Compute Engine Metadata server unavailable on attempt 2 of 3. Reason: timed out
WARNING: Compute Engine Metadata server unavailable on attempt 3 of 3. Reason: [Errno 64] Host is down
ERROR: (gcloud.auth.application-default.print-access-token) Could not automatically determine credentials. Please set GOOGLE_APPLICATION_CREDENTIALS or explicitly create credentials and re-run the application. For more information, please see https://cloud.google.com/docs/authentication/getting-started
{
  "error": {
    "code": 403,
    "message": "The request is missing a valid API key.",
    "status": "PERMISSION_DENIED"
  }
}

What am I doing wrong?

Do not use a service account key file. It's a security bad practice. AND EVEN IF IT'S MENTIONED IN THE GOOGLE CLOUD DOCUMENTATION (and I'm fighting against that and Google for years now!!)

Indeed, the Jordi answer works, but you have to know why.

In the CURL command

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    -d @request.json \
    "https://texttospeech.googleapis.com/v1/text:synthesize"

You don't use the service account, you use the current logged user. Apparently your current user is not authenticated.

You can perform a gcloud auth application-default login to authenticate yourselves. You can also use the alternative to impersonate a service account (if you prefer using the service account roles/permissions) gcloud auth application-default login --impersonate-service-account=<service account email>

However this solution could not work with your curl. Indeed, a user is not linked to a specific project, (as a service account is).

There is a solution to fix that, without using a service account key file. You have to add an additional header x-goog-user-project, to obtain that

curl -X POST \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json; charset=utf-8" \
    -H "x-goog-user-project: <Your Project ID with Text to Speech API activated>" \
    -d @request.json \
    "https://texttospeech.googleapis.com/v1/text:synthesize"

This issue might be related to the use of double quotation marks. I would set it like this:

export GOOGLE_APPLICATION_CREDENTIALS=~/Projects/dbsan2/google-credentials.json

Also make sure that you are setting it as a system wide env variable and not a limited user session one.