GCS Service Account private key not working from env?

The sole purpose of this post is to help people who are googling for the same issue. It took me quite a while before finding the answer. TL;DR: check out this answer.

If you’re trying to initialize gcloud, google-cloud-node, or whatever Google Cloud related npm package on your NodeJS project using secrets stored in environment variables (specifically Service Account private key!) and you’re running into this problem:

[Error: Could not authenticate request
error:0906D06C:PEM routines:PEM_read_bio:no start line]

This is most likely caused by either of these problems (or both):

1. You touched the beginning and end of the private key string, leave them intact! So the string *has to* look like this:

-----BEGIN PRIVATE KEY-----\n[base64encoded...]==\n-----END RPIVATE KEY-----\n

2. When you read in the private key in your NodeJS server application, remember check it’s not amended in any way. If you look at the private key string that’s included in the service account json provided by Google Cloud Console’s IAM manager, it has got a multitude of \n every here and there. Those are converted into \\n‘s when the private key is accessed from the environment variable and they have to be put back in order. So basically do something like this:

const privKey = process.env.PRIVATE_KEY.replace(/\\n/g, '\n');

That’s it.