OK I find it mentioned here, now, related to GCS storage- ... let's see if this is it. Before we were explicitly pulling the credential using a client.Secret()