gcloud ADC Credentials Expired After ~44 Hours; Service Account Key Fixed Scheduled Jobs

A blog's automated job, which pulled Search Console data using gcloud application-default credentials, stopped working about 44 hours after setup. The failure was a "Reauthentication failed" error, since the login used a Google Workspace account whose policy periodically requires re-entering the password. Because a scheduled job has no screen, it cannot answer that prompt, so the credentials became permanently unusable. The author resolved this by switching to a service account key, which neither expires nor requires reauthentication, and exchanging a self-signed JWT for an access token using only Node's crypto module. The service account was given no Google Cloud roles, only read access granted in Search Console, and the key was stored outside the repository with restricted file permissions. The switch also involved several 403 errors, which made it difficult to determine whether the cause was a missing scope, a wrong account, or a wrong project.