gcloud/ADC: WARNING: Your active project does not match the quota project in your local Application Default Credentials file
Application Default Credentials bill API usage to a different project than the one you have set as active, which can cause surprising 403s.
Your active project does not match the quota project in your local Application Default Credentials fileWARNING: Your active project does not match the quota projectCannot find a quota project to add to ADCuser_project_denied USER_PROJECT_DENIEDCaller does not have required permission to use project Meaning
ADC stores a quota project. Local tools (client libraries) use it, while gcloud uses the active project. Align them with gcloud auth application-default set-quota-project PROJECT. If the quota project lacks the API enabled, calls fail with SERVICE_DISABLED.
Common causes
- ADC created before switching projects
- Quota project of a different team/project
- Missing
serviceusage.services.usepermission on the quota project - API not enabled on the quota project
- Impersonation settings overriding the project
⚡ Quick fix
gcloud auth application-default set-quota-project PROJECT- Ensure the API is enabled on that project
- Grant
roles/serviceusage.serviceUsageConsumer
Detailed fix by platform
gcloud
gcloud config get-value projectandcat ~/.config/gcloud/application_default_credentials.json | grep quota_project_id
How to diagnose
- Active — gcloud project?
- ADC — quota_project_id?
- Rights — serviceUsageConsumer?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
- 409: The resource already exists Compute Engine: ERROR: (gcloud.compute.instances.create) Could not fetch resource: The resource 'projects/p/zones/z/instances/vm-1' already exists
- 429 RESOURCE_EXHAUSTED: Quota exceeded for quota metric Google API: 429 RESOURCE_EXHAUSTED — Quota exceeded for quota metric 'Read requests' and limit 'Read requests per minute per user'
- 502 Bad Gateway: failed_to_connect_to_backend Google Cloud Load Balancing: 502 Bad Gateway — jsonPayload.statusDetails: failed_to_connect_to_backend / backend_connection_closed_before_data_sent_to_client
Most viewed in Google Cloud / Firebase
- Missing or insufficient permissions Firestore: FirebaseError: [code=permission-denied]: Missing or insufficient permissions
- Container failed to start Cloud Run: The user-provided container failed to start and listen on the port defined provided by the PORT=8080 environment variable
- Cloud Run 403: Your client does not have permission to get URL Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server
Other ways to find it
Where this error sits
Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 4 Nov 2026